Authentication na yadda ya aiki a Laravel?

Question

Accepted Answer

Laravel yana bada cikakken, secure **authentication system** daga gida — ganin shiga, rajista, haɗa da wuce jiya, jerin aiki, da kariyar hanyoyi. Yana ba da shirye-shiryen farko don aikin web da auth da jeton (Sanctum/Passport) don APIs, don ba za ka gina wannan aikin mai aminci na ƙɓauta ka nan.

## Abubuwan gida (jerin aiki, haɗa jiya, taimako-taimacon auth)

```php
use Illuminate\Support\Facades\Auth;

// attempt login — verifies credentials, establishes a session
if (Auth::attempt(['email' => $email, 'password' => $password])) {
    // logged in — Auth::user() now available everywhere
}
Auth::logout();
Auth::user();        // the authenticated user (or null)
Auth::check();        // is someone logged in?
Auth::id();           // the user's id

// passwords are HASHED automatically (bcrypt) — never plaintext
$user->password = Hash::make($plainPassword);
Hash::check($plain, $user->password);   // verify
```

Laravel yana ganin **secure password hashing** (bcrypt/argon2 — ba plaintext kadan) da jerin sarrafa aiki da kuma ba sauki. `Auth::attempt` yana bada bayanai da yana shigo da mai amfani.

## Kariyar hanyoyi

```php
Route::get('/dashboard', ...)->middleware('auth');   // require login (the auth middleware)

// in Blade
@auth ... @endauth         // content for logged-in users
@guest ... @endguest       // content for visitors
```

**`auth` middleware** yana kariyar hanyoyi (sake dawo/401 idan ba shigowa) — tsarin gida na buƙatar authentication.

## Shirye-shiryen farko da API authentication

```text
Starter kits (Breeze, Jetstream) → scaffold complete login/registration/password-reset
  UI and logic instantly — don't build auth screens by hand.

API authentication:
  ✓ Sanctum → simple token-based auth for SPAs, mobile apps, simple API tokens (common)
  ✓ Passport → full OAuth2 server for complex API auth scenarios
```

Don APIs, **Sanctum** (lightweight token auth) ko **Passport** (cikakken OAuth2) suna ba da jeton da yana tabbatar — kariyar API hanyoyi tare da `auth:sanctum` middleware.

## Why it matters

Authentication yana da mahimmanci da **security-critical** — kusan kowane tunani gaskiya na aikacin yana buƙatar asusu mai amfani da shigo, kuma authentication yana ɗaya daga abubuwan da ba hayaki gaida, hadari a gina su daidai (plaintext passwords, weak hashing, jerin aiki na raunin yana haifar da gaba gaida).

Laravel na bilin authentication system yana babbar maida jiya domin yana ganin wannan daidai da secure daga gida: **secure password hashing** (bcrypt/argon2, ba plaintext kadan — a ganin daidai), jerin sarrafa aiki, da masu yawa `Auth` taimako da **`auth` middleware** don kariyar hanyoyi.

Ganewa yadda za ka daidaita mai amfani, kariyar hanyoyi, da samun mai amfani na jiya shine abubu na asali don gina aikace-aikacen da asusu.

Daidai mahimmanci shine sanin kayan gida: **starter kits** (Breeze, Jetstream) yana haifar cikakken, secure login/rajista/sake saita kalmar siri da sauri (don ba za ka gina alamomin auth na kwatsawa ka nan), kuma don APIs, **Sanctum** (jeton mai sauƙi auth don SPAs/mobile) ko **Passport** (cikakken OAuth2) yana ba da secure jeton-jikewar authentication.

Domin authentication yana kasua koda yana zama tushen hadarin aminci mai mahimmanci idan aka gina shi da hannu, ganewa daidai na Laravel na karfi, secure, batteries-included auth system — abubuwan gida, kariyar hanyoyi, starter kits, da API auth zaɓa — yana mahimmanci ilimi wanda ya ba ka gida don gina secure aikace-aikace na mai amfani ba tare da gida gida (da abube) wannan aikin mahimmanci, babbar fa'ida na amfani da mature framework kamar Laravel.