Types of authentication in online services and authentication in Laravel, with self-check quizzes and answers

Authorization: Bearer token_here

Authorization: Basic base64(login:password)

/unsubscribe?expires=...&signature=...

URL::signedRoute(...)

User → Auth Server → Access Token
→ Service A / Service B

User → Google (IdP) →
OAuth2 token → Laravel app

$user
->createToken('mobile')
->plainTextToken;

Why authentication is needed

• Security — prevents outside users from accessing restricted areas of the site.
• Identification — lets the system "recognize" a specific user and link their actions to an account.
• Personalization — provides access to individual settings, profile, and action history.
• Access control — makes it possible to differentiate user rights (for example, administrator vs. regular user).

The role of sessions and cookies

• Sessions — a mechanism for storing data on the server side. After a successful login, Laravel stores the user's information in the session, so the login and password don't need to be entered again on every request.
• Cookies — small files that the browser stores locally. Laravel writes the session identifier (session_id) into them, to link the user's requests to their server-side session.

Thus, the cookie serves as the "key" and the session as the "lock" that opens access to the user's data. Together they provide a convenient and secure authentication process.

Implementation details in Laravel

• Using guards for different authentication methods (web — via sessions, api — via tokens).
• Configuration in the config/auth.php file, which defines drivers, providers, and access policies.
• Middleware support (auth, guest, verified) for protecting routes.
• The ability to extend via packages (for example, Laravel Sanctum or Passport for APIs).

The main authentication methods in Laravel are as follows:

1. Session authentication
   The classic login via email / password for web applications. Laravel uses sessions, cookies, auth middleware, guards, and providers. This is the standard option for regular sites and admin panels.
2. Starter kits with ready-made authentication
   The official starter kits (or laravel UI) already include ready-made login / register / reset password / email verification / profile settings. The current Laravel documentation states that the starter kits use Fortify under the hood.
3. Laravel Fortify
   This is a backend authentication layer with no ready-made markup. It provides routes and logic for login, registration, reset password, email verification, 2FA, etc. It suits cases where you want to build the UI yourself.
4. Laravel Sanctum
   For SPAs, mobile apps, and simple token-based APIs. Sanctum can work both as session-based auth for SPAs and as API token auth. It's usually the best choice for most modern APIs that don't need full OAuth2.
5. Laravel Passport
   A full OAuth2 server implementation. Needed if you have complex API authentication: access tokens, refresh tokens, third-party clients, OAuth flows. For a regular project it's often overkill compared to Sanctum.
6. Laravel Socialite
   Sign-in via external providers: Google, GitHub, Facebook, LinkedIn, GitLab, Bitbucket, Slack, X, and others. Used for social login via OAuth.
7. HTTP Basic Auth
   A simpler option for when you need to quickly protect a route with basic authentication without a full login form. This is also supported by Laravel's standard auth mechanism.

How to choose in practice:

• Regular site / admin panel → session auth + starter kit / Fortify
• SPA on Vue / React + Laravel backend → usually Sanctum
• Public API with OAuth2 clients → Passport
• Sign-in via Google / GitHub → Socialite
• Only need a backend without a ready-made UI → Fortify

Practical Assignment

Steps to build authentication in Laravel without using third-party libraries

1. Database Setup

• In the .env file, specify the DB connection parameters.

• Run the migration for the users table:

  php artisan migrate
  

  By default, a users table is created with the fields name, email, password.

2. Creating Routes

In routes/web.php, add routes for registration, login, and logout:

use App\Http\Controllers\AuthController;

Route::get('/register', [AuthController::class, 'showRegisterForm']);
Route::post('/register', [AuthController::class, 'register']);

Route::get('/login', [AuthController::class, 'showLoginForm']);
Route::post('/login', [AuthController::class, 'login']);

Route::post('/logout', [AuthController::class, 'logout'])->middleware('auth');

3. Authentication Controller

Create the controller:

php artisan make:controller AuthController

Example methods:

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Hash;
use App\Models\User;

class AuthController extends Controller
{
    public function showRegisterForm() {
        return view('auth.register');
    }

    public function register(Request $request) {
        $request->validate([
            'name' => 'required|string|max:255',
            'email' => 'required|email|unique:users',
            'password' => 'required|min:6|confirmed',
        ]);

        User::create([
            'name' => $request->name,
            'email' => $request->email,
            'password' => Hash::make($request->password),
        ]);

        return redirect('/login')->with('success', 'Registration on intellect.icu was successful!');
    }

    public function showLoginForm() {
        return view('auth.login');
    }

    public function login(Request $request) {
        $credentials = $request->validate([
            'email' => 'required|email',
            'password' => 'required',
        ]);

        if (Auth::attempt($credentials)) {
            $request->session()->regenerate();
            return redirect()->intended('/dashboard');
        }

        return back()->withErrors([
            'email' => 'Invalid credentials.',
        ]);
    }

    public function logout(Request $request) {
        Auth::logout();
        $request->session()->invalidate();
        $request->session()->regenerateToken();
        return redirect('/login');
    }
}

4. Forms (Blade Templates)

Example registration form (resources/views/auth/register.blade.php):

Example login form (resources/views/auth/login.blade.php):

5. Middleware for Protecting Routes

In routes/web.php:

Route::get('/dashboard', function () {
    return view('dashboard');
})->middleware('auth');

6. Summary

• The built-in Laravel Auth facade is used.

• Passwords are hashed via Hash::make.

• Sessions are managed automatically.

• No third-party packages are required.

Test Assignment

Study the topics and complete the corresponding practical assignment, then for each test question, choose one of the 4 answer options

1. Which Laravel component is responsible for authenticating users?

• A) Middleware
• B) Auth Facade *
• C) Blade
• D) Route

Hint: Auth is the main facade for checking the user.

2. Which artisan command creates the base authentication system?

• A) php artisan make:auth *
• B) php artisan auth:install
• C) php artisan auth:create
• D) php artisan make:user

Hint: Older versions of Laravel used make:auth.

3. Where does Laravel store information about the current user?

• A) In the session *
• B) In the cookies
• C) In the database
• D) In Blade templates

Hint: After login, the user's data is stored in the session.

4. Which method checks whether a user is logged in?

• A) Auth::check() *
• B) Auth::login()
• C) Auth::user()
• D) Auth::attempt()

Hint: check() returns true/false.

5. Which method is used to log in a user from form data?

• A) Auth::login()
• B) Auth::guard()
• C) Auth::check()
• D)Auth::attempt() *

Hint: attempt() checks the email/password.

6. Which guard is used by default in Laravel?

• A) api
• B) web *
• C) custom
• D) session

Hint: the web guard works via sessions and cookies.

7. Where are guards and providers configured?

• A) config/app.php
• B) config/auth.php *
• C) routes/web.php
• D) .env

Hint: All authentication settings are in config/auth.php.

8. Which method returns the current user object?

• A) Auth::id()
• B) Auth::user() *
• C) Auth::check()
• D) Auth::attempt()

Hint: user() returns the User model.

9. How do you log out?

• A) Auth::close()
• B) Auth::exit()
• C) Auth::destroy()
• D) Auth::logout() *

Hint: logout() clears the session data.

10. Which middleware protects routes from unauthorized users?

• A) guest
• B) auth *
• C) verified
• D) throttle

Hint: the auth middleware checks login.

11. Which method returns the ID of the current user?

• A) Auth::check()
• B) Auth::user()
• C) Auth::id() *
• D) Auth::attempt()

Hint: id() returns the numeric identifier.

12. Which class is responsible for storing passwords in Laravel?

• A) Hash *
• B) Crypt
• C) Password
• D) Encrypt

Hint: Hash::make() is used for hashing.

13. Which method is used to verify a password?

• A)Hash::verify()
• B) Auth::check()
• C) Auth::attempt()
• D) Hash::check() *

Hint: Hash::check() compares the entered password with the hash.

14. Which middleware checks email confirmation?

• A) auth
• B) guest
• C) verified *
• D) throttle

Hint: verified requires a confirmed email.

15. Which method is used to log in a user manually?

• A) Auth::check()
• B) Auth::attempt()
• C) Auth::login() *
• D) Auth::user()

Hint: login() accepts a User object.

16. Which class is used by default for the user model?

• A) Admin
• B) User *
• C) Account
• D) Profile

Hint: Laravel creates a User model during installation.

17. Which method is used to log in a user by their ID?

• A) Auth::login()
• B) Auth::loginUsingId() *
• C) Auth::attempt()
• D) Auth::user()

Hint: loginUsingId() allows authorization without a password.

18. Which middleware denies access to authenticated users?

• A) throttle
• B) auth
• C) verified
• D) guest *

Hint: guest is used for login and registration pages.

19. Which method is used to remember a user across sessions?

• A) Auth::remember()
• B) Auth::attempt(['remember' => true]) *
• C) Auth::keep()
• D) Auth::session()

Hint: remember works via a flag in attempt().

20. Which file is responsible for configuring the access policy (Policies)?

• A) config/auth.php
• B) AuthServiceProvider.php *
• C) routes/web.php
• D) Kernel.php

Hint: AuthServiceProvider registers policies.

21. Which guard is most often used for the API?

• A) web
• B) api *
• C) session
• D) token

Hint: the api guard works without sessions, via tokens.

22. Which method is used to authorize directly via the User model?

• A) Auth::check($user)
• B) Auth::attempt($user)
• C) Auth::login($user) *
• D) Auth::user($user)

Hint: login() accepts a User model object.

23. Which method returns true if the user is a guest?

• A) Auth::guest() *
• B) Auth::check()
• C) Auth::user()
• D) Auth::id()

Hint: guest() is the opposite of check().

24. Which middleware limits the number of requests to protect against brute force?

• A) auth
• B) guest
• C) throttle *
• D) verified

Hint: throttle limits the request rate.

25. Which method is used to check whether a user is authenticated via a specific guard?

• A) Auth::attempt('web')
• B) Auth::user('web')
• C) Auth::guard('web')->check() *
• D) Auth::login('web')

Hint: check() works within the selected guard.

26. Which method returns the current guard?

• A) Auth::guard() *
• B) Auth::get()
• C) Auth::current()
• D) Auth::session()

Hint: guard() allows switching between web and api.

27. Which middleware is used to protect API routes?

• A) auth:api *
• B) api:auth
• C) guest:api
• D) throttle:api

Hint: auth:api checks the token or the API guard.

28. Which method is used for one-off authentication of a user?

• A) Auth::once() *
• B) Auth::login()
• C) Auth::attempt()
• D) Auth::guest()

Hint: once() authenticates for a single request only.

29. Which method is used to log in a user without saving to the session?

• A) Auth::onceUsingId() *
• B) Auth::loginUsingId()
• C) Auth::attempt()
• D) Auth::check()

Hint: onceUsingId() works only for the current request.

30. Which class is responsible for resetting the password?

• A) Hash Manager
• B) Password Broker *
• C) Auth Provider
• D) Session Manager

Hint: the Password Broker manages password reset tokens.

31. Which method is used to send a password reset link?

• A) Password::sendResetLink() *
• B) Auth::reset()
• C) User::resetPassword()
• D) Mail::reset()

Hint: sendResetLink() generates an email with a token.

32. Which method is used to actually reset the password?

• A) Password::reset() *
• B) Auth::reset()
• C) User::updatePassword()
• D) Hash::reset()

Hint: reset() accepts a callback to update the password.

33. Which method is used to verify the email during registration?

• A) the MustVerifyEmail interface *
• B) Auth::verify()
• C) User::confirm()
• D) Email::check()

Hint: the User model must implement MustVerifyEmail.

34. Which middleware is used to check email confirmation?

• A) throttle
• B) auth
• C) guest
• D) verified *

Hint: verified blocks access without a confirmed email.

35. Which method is used to obtain an API token?

• A) $user->createToken('token') *
• B) Auth::token()
• C) User::getToken()
• D) Auth::apiToken()

Hint: createToken() is used in Laravel Sanctum/Passport.

36. Which Laravel package is most often used for API authentication?

• A) Sanctum *
• B) Horizon
• C) Telescope
• D) Scout

Hint: Sanctum provides simple token authentication.

37. Which method is used to verify a token in Sanctum?

• A) User::verifyToken()
• B) Auth::token()
• C) Auth::check()
• D) $request->user() *

Hint: user() returns the user model by token.

38. Which method is used to delete a token in Sanctum?

• A) $user->tokens()->delete() *
• B) Auth::logout()
• C) Auth::removeToken()
• D) User::clearToken()

Hint: tokens()->delete() clears all of the user's tokens.

39. Which file is responsible for configuring authentication drivers?

• A) config/session.php
• B) config/auth.php *
• C) config/app.php
• D) config/database.php

Hint: guards and providers are configured in config/auth.php.

40. Which guard is used to check API tokens?

• A) web
• B) api *
• C) session
• D) token

Hint: the api guard works without sessions, via tokens.

41. Which method is used to log in a user by ID?

• A) Auth::loginUsingId($id) *
• B) Auth::attemptId($id)
• C) Auth::userId($id)
• D) Auth::checkId($id)

Hint: loginUsingId() authenticates without a password.

42. Which method is used for one-off authentication without saving to the session?

• A) Auth::once() *
• B) Auth::login()
• C) Auth::attempt()
• D) Auth::guest()

Hint: once() works only for the current request.

43. Which method is used for one-off authentication by ID?

• A) Auth::onceUsingId($id) *
• B) Auth::loginUsingId($id)
• C) Auth::attemptId($id)
• D) Auth::checkId($id)

Hint: onceUsingId() authenticates for a single request only.

44. Which method is used to log in a user with the "Remember me" option?

• A) Auth::attempt(['email' => $email, 'password' => $password, 'remember' => true]) *
• B) Auth::loginRemember()
• C) Auth::keep()
• D) Auth::sessionRemember()

Hint: remember works via a flag in attempt().

45. Why does Laravel use sessions during authentication?

• A) To store passwords
• B) To store the current user's data *
• C) To store Blade templates
• D) To store migrations

Hint: after login, the user's data is stored in the session.

46. Where does Laravel store the session identifier?

• A) In the database
• B) In the browser cookie *
• C) In the Blade template
• D) In config/app.php

Hint: the cookie contains the session_id to link the session and the user.

47. Which middleware is responsible for starting the session?

• A) VerifyCsrfToken
• B) Auth
• C) Kernel
• D) StartSession *

Hint: StartSession initializes session handling.

48. Which method returns all the current session data?

• A) session()->all() *
• B) Auth::all()
• C) Cookie::all()
• D) User::session()

Hint: session() is the global helper for working with the session.

49. Which method is used to get a value from the session?

• A) User::session('key')
• B) Auth::get('key')
• C) Cookie::get('key')
• D) session('key') *

Hint: session('key') returns the value by key.

50. Which method is used to write a value into the session?

• A) session(['key' => 'value']) *
• B) Auth::put('key','value')
• C) Cookie::set('key','value')
• D) User::session('key','value')

Hint: session() accepts an array for writing.

51. Which method is used to remove a value from the session?

• A) session()->forget('key') *
• B) session()->remove('key')
• C) Auth::forget('key')
• D) Cookie::forget('key')

Hint: forget() removes a value by key.

52. Which method is used to clear the entire session?

• A) Cookie::flush()
• B) session()->clear()
• C) Auth::flush()
• D) session()->flush() *

Hint: flush() removes all session data.

53. What are cookies used for in the authentication mechanism?

• A) To store HTML
• B) To store the session_id *
• C) To store Blade templates
• D) To store migrations

Hint: cookies link the browser to the server-side session.

54. Which method is used to set a cookie in Laravel?

• A) Cookie::create()
• B) Cookie::set()
• C) Cookie::make() *
• D) Cookie::new()

Hint: make() creates a new cookie object.

55. Which method is used to get a cookie?

• A) Cookie::session('name')
• B) Cookie::read('name')
• C) Cookie::get('name') *
• D) Cookie::value('name')

Hint: get() returns the cookie value by name.

56. Which method is used to remove a cookie?

• A) Cookie::forget('name') *
• B) Cookie::remove('name')
• C) Cookie::delete('name')
• D) Cookie::clear('name')

Hint: forget() removes the cookie.

57. Which cookie parameter is responsible for its expiration time?

• A) duration
• B) time
• C) expire *
• D) lifetime

Hint: expire sets the cookie's lifetime.

58. Which cookie parameter restricts access to HTTPS only?

• A) ssl
• B) httpOnly
• C) secure *
• D) safe

Hint: secure=true makes the cookie accessible only over HTTPS.

59. Which cookie parameter blocks access to it via JavaScript?

• A) httpOnly *
• B) secure
• C) hidden
• D) private

Hint: httpOnly protects the cookie from XSS attacks.

60. What is JWT?

• A) A compact token format for transmitting data between the client and the server *
• B) A special database encryption algorithm
• C) A protocol for transferring files over a network
• D) A browser session management system

Hint: JWT stands for JSON Web Token and consists of a header, a payload, and a signature.

61. How does JWT differ from classic session-based authentication?

• A) Sessions only work in mobile apps
• B) JWT is stored on the server and does not require storing state on the client
• C) JWT is stored on the client and does not require storing state on the server *
• D) JWT cannot be used in a browser

Hint: with sessions the server stores the state, while JWT is a self-contained token.

62. What is a key advantage of JWT?

• A) Encrypting the cookie key on the client side
• B) Automatic password generation
• C) The ability to store data directly inside the token *
• D) Speeding up site loading

Hint: useful for transmitting claims without contacting the server.

63. What is the weakness of session-based authentication compared to JWT?

• A)Cannot use cookies
• B) Does not support HTTPS
• C) Requires storing state on the server (only in files)
• D) Requires storing state on the server (in files or in the DB)*

Hint: scaling sessions requires distributed storage.

64. How does OAuth2 differ from OAuth1?

• A) OAuth2 only works with XML O
• B)Auth2 uses access tokens and refresh tokens instead of signing every request *
• C) OAuth1 is always faster than OAuth2
• D) OAuth2 does not support browsers

Hint: OAuth1 requires a cryptographic signature for every request, while OAuth2 simplified the model with bearer tokens and a refresh mechanism.

65. How does OAuth1 differ from JWT?

• A) OAuth1 uses signatures for every request *
• B) OAuth1 stores the token in localStorage
• C) JWT always requires HTTPS
• D) JWT cannot be signed

Hint: OAuth1 is more complex because it requires signing every request.

66. What do JWT and OAuth2 have in common?

• A) Both are supported out of the box by all modern browsers and require no additional packages
• B) Both require cookies
• C) Both use only RSA signatures
• D) Both can use Bearer tokens *

Hint: the word Bearer often appears in the Authorization header.

67. How is JWT more convenient than OAuth1?

• A) JWT automatically updates the password
• B) JWT always works faster than the internet
• C) JWT is simpler to use because it does not require signing every request *
• D) JWT cannot be stolen

Hint: signing every request in OAuth1 makes it cumbersome.

68. How is access renewed when using OAuth2?

• A) Through an automatic IP change
• B) Through the browser cookie
• C) Through a refresh token *
• D) Through a JWT with no expiration

Hint: a refresh token allows obtaining a new access token.

69. What does JWT store inside itself?

• A) Only the user's password
• B) Only the client's IP address
• C) Only the server's lifetime
• D) A header, a payload, and a signature *

Hint: the token's structure consists of three parts.

70. What is the difference between OAuth2 and session-based authorization?

• A) OAuth2 allows delegating access to third-party applications *
• B) OAuth2 always stores data in cookies
• C) Sessions only work with APIs
• D) OAuth2 does not support HTTPS

Hint: OAuth2 is often used for signing in via Google or Facebook.

71. What is a drawback of JWT compared to sessions?

• A) If the token is compromised, the attacker has full access until it expires *
• B) JWT cannot be used in mobile apps
• C) JWT always requires a database
• D) JWT cannot be signed

Hint: the server cannot revoke a token before it expires without additional mechanisms.

72. Which packages (vendors) does Laravel typically use for sessions, basic authorization, OAuth2, and JWT?

• A) Laravel/ui or Breeze for sessions and basic authorization, Passport for OAuth2, tymon/jwt-auth for JWT *
• B) Only Laravel/ui for all cases
• C) Composer automatically connects all the needed packages itself
• D) JWT is built into the Laravel core and needs no package

Hint: Laravel has built-in support for sessions and basic authentication, but for OAuth2 Passport is used, and for JWT a separate package, such as tymon/jwt-auth.

73. Can OAuth2 be used without HTTPS?

• A) No, OAuth2 inherently forbids working without HTTPS
• B) Yes, this is the standard mode of operation
• C) Theoretically possible, but extremely insecure *
• D) Only if JWT is used without a signature

Hint: the OAuth2 specification allows working without HTTPS, but this opens up the possibility of token interception, so in practice a secure connection is always recommended.

74. Why are two tokens needed in OAuth2 (access and refresh)?

• A) The access token is used to access resources, while the refresh token is used to renew access *
• B) The access token stores the password, while the refresh token stores the login
• C) The access token is needed only for browsers, while the refresh token is for mobile apps
• D) The access token is always permanent, while the refresh token limits the server's lifetime

Hint: the access token has a limited lifetime, while the refresh token allows safely obtaining a new access token without re-entering the password.

75. Why can't the access token and refresh token be combined into one in OAuth2?

• A)Because they are generated by different parties of the network interaction, one by the server, the other by the client
• B) Because the specification forbids using a single token and requires these two different tokens to be used
• C) Because browsers do not support a single token
• D) Because the separation improves security: the access token is short-lived, while the refresh token is stored longer *

Hint: if there were only one token, its compromise would give an attacker long-term access. The separation limits the risk: the access token expires quickly, while the refresh token is only used to renew it.

76. Which party in the network interaction generates the access token and the refresh token in OAuth2?

• A) The refresh token is always created by the browser, while the server creates the access token
• B) The server side generates the access token, the refresh token is created by the client side
• C) The server side generates both tokens, the client receives them for use *
• D) The client side generates the access token, the refresh token is created by the server side

Hint: the client has no right to create tokens itself — it receives them from the authorization server, which is responsible for security and expiration.

See also

• [[b14136]]
• [[b14135]]