Laravel 5.7
PHP 7.2.10
当前，我能够使用Web和api防护中的任何一种，有什么方法可以同时使用两者，以便Web应用程序和api能够一起工作。
类似
return [
/*
|--------------------------------------------------------------------------
| Authentication Defaults
|--------------------------------------------------------------------------
|
| This option controls the default authentication "guard" and password
| reset options for your application. You may change these defaults
| as required, but they're a perfect start for most applications.
|
*/
'defaults' => [
'guard' => 'api|web',
'passwords' => 'users',
],
在不使用架构的情况下，here是需要更改架构的解决方案/解决方法，我不希望这样做。另外，我不需要访问令牌进行注册，这个答案在做什么。
api.php
Route::group([
'middleware' => 'api|web',
'prefix' => 'auth'
], function ($router) {
Route::post('register', 'Auth\AuthController@register')->name('api.register');
Route::post('forgot-password', 'Auth\ForgotPasswordController@forgotPassword')->name('api.forgot-password');
Route::post('login', 'Auth\AuthController@login')->name('api.login');
Route::middleware('auth')->post('logout', 'Auth\AuthController@logout')->name('api.logout');
web.php
Auth::routes(['verify' => true]);
Route::prefix('admin')->group(function () {
Route::middleware('auth', 'permission:super-admin|association-member')->resource('users', 'Auth\UserController');
});
config / auth.php
return [
/*
|--------------------------------------------------------------------------
| Authentication Defaults
|--------------------------------------------------------------------------
|
| This option controls the default authentication "guard" and password
| reset options for your application. You may change these defaults
| as required, but they're a perfect start for most applications.
|
*/
'defaults' => [
'guard' => 'web', //api
'passwords' => 'users',
],
/*
|--------------------------------------------------------------------------
| Authentication Guards
|--------------------------------------------------------------------------
|
| Next, you may define every authentication guard for your application.
| Of course, a great default configuration has been defined for you
| here which uses session storage and the Eloquent user provider.
|
| All authentication drivers have a user provider. This defines how the
| users are actually retrieved out of your database or other storage
| mechanisms used by this application to persist your user's data.
|
| Supported: "session", "token"
|
*/
'guards' => [
'web' => [
'driver' => 'session',
'provider' => 'users',
],
'api' => [
'driver' => 'jwt',
'provider' => 'users',
],
],
更新
正如@apokryfos所说，If you want both to work for both then yes. However, I think that's bad practice. API routes should only allow API authentication since web authentication usually uses the session which API routes don't use anyway. If I were you I'd take a step back and rethink my entire strategy.
我也不想同时使用这两种方法，我只想同时使用api和网络应用程序，现在我可以使用其中任何一种。
更新2 由于@Lim Kean Phang建议使用git问题链接
我改变了
protected function respondWithToken($token)
{
return response()->json([
'access_token' => $token,
'token_type' => 'bearer',
'expires_in' => auth('api')->factory()->getTTL() * 60,//auth()->factory()->getTTL() * 60,
'status' => 200,
"response" => "Successfully login",
]);
}
expires_in值，但是现在我没有获得访问令牌。
api响应是
{
"access_token": true,
"token_type": "bearer",
"expires_in": 31536000,
"status": 200,
"response": "Successfully login"
}
更新3 添加了一个github问题，因为找不到任何可行的解决方案来使其正常工作。
答案 0 :(得分：1)
API路线，您应该使用chrome / app中的邮递员来测试API
Route::group(['prefix' => 'auth',namespace =>'App\Http\Controller'], function () {
Route::post('login', 'Auth\AuthController@login')->name('api.login');
Route::group(['middleware' => 'auth:api'], function () {
Route::post('register', 'Auth\AuthController@register')->name('api.register');
Route::post('forgot-password', 'Auth\ForgotPasswordController@forgotPassword')->name('api.forgot-password');
Route::post('logout', 'Auth\AuthController@logout')->name('api.logout');
});
});
Config / auth.php
return [
/*
|--------------------------------------------------------------------------
| Authentication Defaults
|--------------------------------------------------------------------------
|
| This option controls the default authentication "guard" and password
| reset options for your application. You may change these defaults
| as required, but they're a perfect start for most applications.
|
*/
'defaults' => [
'guard' => 'web',
'passwords' => 'users',
],
/*
|--------------------------------------------------------------------------
| Authentication Guards
|--------------------------------------------------------------------------
|
| Next, you may define every authentication guard for your application.
| Of course, a great default configuration has been defined for you
| here which uses session storage and the Eloquent user provider.
|
| All authentication drivers have a user provider. This defines how the
| users are actually retrieved out of your database or other storage
| mechanisms used by this application to persist your user's data.
|
| Supported: "session", "token"
|
*/
'guards' => [
'web' => [
'driver' => 'session',
'provider' => 'users',
],
'api' => [
'driver' => 'jwt',
'provider' => 'users',
],
],
答案 1 :(得分：0)
我将AuthController更改为类似的
<?php
namespace App\Http\Controllers;
use Auth;
use Illuminate\Http\Request;
class AuthController extends Controller
{
/**
* Create a new AuthController instance.
*
* @return void
*/
public function __construct()
{
$this->middleware('auth:api', ['except' => ['login']]);
}
/**
* Get a JWT via given credentials.
*
* @return \Illuminate\Http\JsonResponse
*/
public function login()
{
$credentials = request(['username', 'password']);
$token = auth()->guard('api')->attempt($credentials);
if (!$token) {
return response()->json(['error' => 'Unauthorized'], 401);
}
return $this->respondWithToken($token);
}
/**
* Log the user out (Invalidate the token).
*
* @return \Illuminate\Http\JsonResponse
*/
public function logout()
{
auth()->guard('api')->logout();
return response()->json(['message' => 'Successfully logged out']);
}
/**
* Refresh a token.
*
* @return \Illuminate\Http\JsonResponse
*/
public function refresh()
{
return $this->respondWithToken(auth()->refresh());
}
/**
* Get the token array structure.
*
* @param string $token
*
* @return \Illuminate\Http\JsonResponse
*/
protected function respondWithToken($token)
{
return response()->json([
'access_token' => $token,
'token_type' => 'bearer',
'expires_in' => auth('api')->factory()->getTTL() * 60,
]);
}
}
在api.php中，将auth更改为jwt.auth即可解决问题。
Route::group([
'middleware' => 'api',
'prefix' => 'auth'
], function ($router) {
Route::post('register', 'Auth\AuthController@register')->name('api.register');
Route::post('forgot-password', 'Auth\ForgotPasswordController@forgotPassword')->name('api.forgot-password');
Route::post('login', 'Auth\AuthController@login')->name('api.login');
Route::middleware('jwt.auth')->post('logout', 'Auth\AuthController@logout')->name('api.logout');
Route::middleware('auth')->post('refresh', 'Auth\AuthController@refresh')->name('api.refresh');
Route::middleware('jwt.auth')->post('me', 'Auth\AuthController@me')->name('api.me');
});
答案 2 :(得分：0)
我本人只是遇到了这个问题，并发表了答案，以防有人觉得有用。
就我而言，我需要网站和外部客户端都可以访问我的API。该网站使用session防护，因为浏览器会在每个请求中自动包含任何会话cookie。其他客户端将api保护与token驱动程序一起使用，因为它们不处理cookie，而是使用users表中的token_id字段。
// contig/auth.php
'guards' => [
'web' => [
'driver' => 'session',
'provider' => 'users',
],
'api' => [
'driver' => 'token',
'provider' => 'users',
],
],
现在我可以像这样保护我的路线了
// routes/api.php
Route::group(['middleware' => ['auth:web,api']], function () {
Route::get('/abc', 'MyController@abc');
});
请注意Laravel开箱即用的web,api语法，但未记录。通过分析Laravel的源代码，我意识到这是可能的。
答案 3 :(得分：0)
在构造函数中设置默认驱动程序也可以：
public function __construct() {
auth()->setDefaultDriver('api');
}
如果您正确配置了所有内容，则调用Auth::guard()应该返回Tymon\JWTAuth\JWTGuard
或者，您也可以将驱动程序作为参数传递给guard方法，如下所示：
private method guard() {
return Auth::guard('api'); // Tymon\JWTAuth\JWTGuard
}
答案 4 :(得分：-1)
您不能同时使用两个防护（Web和api），因此您要做的是使用JWTAuth :: attempt函数生成jwt，如下所示。
use JWTAuth;
public function login(){
$credentials = request(['email', 'password']);
if (! $token = JWTAuth::attempt($credentials)) {
return response()->json(['error' => 'Unauthorized'], 401);
}
return response()->json(['status'=>200,'token'=>$token]);
}
这将生成令牌，您将能够使用这两个身份验证防护。