How does authentication work in Laravel?

Question

Accepted Answer

Laravel provides a complete, secure **authentication system** out of the box — handling login, registration, password hashing, sessions, and route protection. It offers ready-made starter kits for web apps and token-based auth (Sanctum/Passport) for APIs, so you don't build this security-critical functionality yourself.

## The basics (sessions, hashing, the auth helpers)

```php
use Illuminate\Support\Facades\Auth;

// attempt login — verifies credentials, establishes a session
if (Auth::attempt(['email' => $email, 'password' => $password])) {
    // logged in — Auth::user() now available everywhere
}
Auth::logout();
Auth::user();        // the authenticated user (or null)
Auth::check();        // is someone logged in?
Auth::id();           // the user's id

// passwords are HASHED automatically (bcrypt) — never plaintext
$user->password = Hash::make($plainPassword);
Hash::check($plain, $user->password);   // verify
```

Laravel handles **secure password hashing** (bcrypt/argon2 — never plaintext) and session management automatically. `Auth::attempt` verifies credentials and logs the user in.

## Protecting routes

```php
Route::get('/dashboard', ...)->middleware('auth');   // require login (the auth middleware)

// in Blade
@auth ... @endauth         // content for logged-in users
@guest ... @endguest       // content for visitors
```

The **`auth` middleware** protects routes (redirecting/401 if not logged in) — the standard way to require authentication.

## Starter kits and API authentication

```text
Starter kits (Breeze, Jetstream) → scaffold complete login/registration/password-reset
  UI and logic instantly — don't build auth screens by hand.

API authentication:
  ✓ Sanctum → simple token-based auth for SPAs, mobile apps, simple API tokens (common)
  ✓ Passport → full OAuth2 server for complex API auth scenarios
```

For APIs, **Sanctum** (lightweight token auth) or **Passport** (full OAuth2) issue and verify tokens — protecting API routes with `auth:sanctum` middleware.

## Why it matters

Authentication is essential and **security-critical** — nearly every real application needs user accounts and login, and authentication is one of the most error-prone, dangerous things to implement incorrectly (plaintext passwords, weak hashing, session vulnerabilities lead to serious breaches).

Laravel's built-in authentication system is a major benefit because it handles this correctly and securely out of the box: **secure password hashing** (bcrypt/argon2, never plaintext — handled automatically), session management, and the convenient `Auth` helpers and **`auth` middleware** for protecting routes.

Understanding how to authenticate users, protect routes, and access the current user is fundamental for building applications with accounts.

Equally important is knowing the ecosystem tools: **starter kits** (Breeze, Jetstream) scaffold complete, secure login/registration/password-reset functionality instantly (so you don't build error-prone auth screens by hand), and for APIs, **Sanctum** (simple token auth for SPAs/mobile) or **Passport** (full OAuth2) provide secure token-based authentication.

Since authentication is both ubiquitous and a frequent source of dangerous security mistakes when hand-rolled, understanding Laravel's robust, secure, batteries-included auth system — the basics, route protection, starter kits, and API auth options — is important knowledge that lets you build secure user-facing applications without reinventing (and risking) this critical functionality, a key advantage of using a mature framework like Laravel.