Laravel's 5.3 passport and api routes

Question

I\'m using Laravel Framework version 5.3.9, fresh download nothing added on via composer(except \"laravel/passport\": \"^1.0\").

I did all the things su

Answer 1

Because the marked answer was noted as correct I feel it necessary to note some key points that many I think would agree with:

1. You almost NEVER want put server process logic of that kind within your routes directory. Especially when working to create an API with the intent to put it into production. It's a dirty route to take and not entirely safe. UNLESS it's for things that are safe to process within your routes directory. Like, on a lesser scale, the base logic for sending a notification (SMS,email,push,slack) to staff members about a new letter/blog/memo being published as an example.

2. ALWAYS attempt to leverage and make use of as much of a framework's features as possible before attempting to "hackishly" accomplish a task that may have been accomplished multiple times before.

3. Ensure that you're doing the proper research about something that has been accomplished already. That way it makes it easier to simply reference a video or tutorial that shows how to properly do what someone is trying to do.

That being said, a good starting point would be to watch the following video that perfectly describes the basics of how to properly set up what you're looking to set up:

https://laracasts.com/series/whats-new-in-laravel-5-3/episodes/13

In many respects, the video tutorial is very well done and thorough from start to finish. Be sure to brush up on the different Grant_Types for OAuth2.0 as well so you'll have a better understanding as to what specific type you/your application need based on your application's position to consume the api:

https://www.digitalocean.com/community/tutorials/an-introduction-to-oauth-2

In addition, be sure to USE laravel's out-of-the-box features for login and register when creating or logging in users. The Controllers are built for you when you perform the following in your console:

php artisan make:auth

Aside from that, if passport is some-what of a mystery, you can always pull in laravel/socialite package (https://github.com/laravel/socialite). It will allow you to "Log in with (Social Network Here)". Provided that is the route you're also aiming to go.

END NOTE: The piece I saw in your question that stuck out the most was how a person will register but will not login with facebook. Instead will have an access token to hit various API endpoints. So if I'm getting what you're saying right, you're aiming to use a user's data from facebook when data is returned, the user is considered logged in and is to be issued an access token. SO:

1. Use socialite to send a "login with facebook" request to facebook. This will get the user's data and leverage a bit of facebook's process of authentication.

2. When a request is returned with user data within the body run it through a check to ensure that there is data (a simply if statement should be fine). Since facebook will have already authenticated that user and the sent credentials you should be good to go.

3. You can either fire off an internal proxy within your Login Controller (which is the cleaner and safer way to do it) or you can issue a JWT (Which is covered in the last 5 minutes of the video posted in this answer above).

   Below is some example code to get you started.

   App\Http\Controllers\Auth\LoginController.php

   class LoginController extends Controller
   {
   
       // ...
   
       protected function authenticateClient(Request $request) {
   
           $credentials = $this->credentials($request);
   
           $data = $request->all();
   
           $user = User::where('email', $credentials['email'])->first();
   
           $request->request->add([
               'grant_type'    => $data['grant_type'],
               'client_id'     => $data['client_id'],
               'client_secret' => $data['client_secret'],
               'username'      => $credentials['email'],
               'password'      => $credentials['password'],
               'scope'         => null,
           ]);
   
           $proxy = Request::create(
               'oauth/token',
               'POST'
           );
   
           return Route::dispatch($proxy);
       }
   
       protected function authenticated(Request $request, $user) {
   
           return $this->authenticateClient($request);
       }
   
       protected function sendLoginResponse(Request $request)
       {
           $request->session()->regenerate();
   
           $this->clearLoginAttempts($request);
   
           return $this->authenticated($request, $this->guard()->user());
   
       }
   
       public function login(Request $request)
       {
   
           if ($this->guard('api')->attempt($credentials, $request->has('remember'))) {
   
               return $this->sendLoginResponse($request);
           }
       }
   }
   

The code above is used IN CASE you're aiming to use the Password Grant type for authenticating clients through passport. However, I would seriously look at the tutorial video before jumping the gun on anything. It WILL help you out a lot with how to use laravel 5.3 with passport.