Authentication
Authentication establishes who is making the request.
What it is
Authentication establishes who is making the request.
When to use it
Use session auth for browser apps; choose token auth deliberately for APIs.
Syntax
Auth::attempt($credentials);
$request->session()->regenerate();Example
if (!Auth::attempt($request->validate([
"email" => "required|email", "password" => "required|string",
]))) {
throw ValidationException::withMessages(["email" => "Invalid credentials"]);
}
$request->session()->regenerate();
// Logout:
Auth::logout();
$request->session()->invalidate();
$request->session()->regenerateToken();Common mistakes
Rate-limit login; avoid revealing whether an account exists; authentication is not authorization.