Skip to content

Laravel 9 application demonstrating Auth0 integration, using the Auth0 Laravel SDK.

License

Notifications You must be signed in to change notification settings

auth0-samples/laravel

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Auth0 Laravel SDK

📚 Documentation — :rocket: Getting Started — :round_pushpin: Routes — :wrench: Default Changes

This is a sample project demonstrating how to integrate the Auth0 Laravel SDK into a Laravel 9 application. For Laravel 10 applications, the integration steps are identical.

Documentation

Guidance on integrating Auth0 into your Laravel application can be found here:

You may also find the following documentation from the SDK's GitHub repository useful:

Getting Started

Use Composer's create-project command to clone this repository and install the dependencies:

composer create-project auth0-samples/laravel auth0-laravel-quickstart && cd auth0-laravel-quickstart

Authenticate with Auth0 using the bundled Auth0 CLI:

./auth0 login

Note
Authenticate as a "user" if prompted.

Create an Auth0 Application:

./auth0 apps create \
  --name "My Laravel Backend" \
  --type "regular" \
  --auth-method "post" \
  --callbacks "http://localhost:8000/callback" \
  --logout-urls "http://localhost:8000" \
  --reveal-secrets \
  --no-input \
  --json > .auth0.app.json

Create an Auth0 API:

./auth0 apis create \
  --name "My Laravel Backend API" \
  --identifier "https://github.com/auth0/laravel-auth0" \
  --offline-access \
  --no-input \
  --json > .auth0.api.json

Run the application:

php artisan serve

Demonstration Routes

This sample includes a few demonstration routes to help you get started.

Session-Based Authentication

The SDK automatically registers the following routes for session-based authentication:

Method Route Description
GET /login Starts the user authentication flow. Sets up some initial cookies, and redirects to Auth0 to authenticate.
GET /callback Handles the return callback from Auth0. Completes setting up the user's Laravel session.
GET /logout Logs the user out.

The routes/web.php file contains routes that demonstrate working with session-based authentication. These are:

Method Route Description
GET /private Demonstrates how to protect a route with the auth middleware.
GET /scope Demonstrates how to protect a route with the can middleware.
GET /colors Demonstrates how to make Management API calls.

Token-Based Authorization

The routes/api.php file contains routes that demonstrate token-based authorization. These are:

Method Route Description
GET /api Demonstrates how to extract information from the request token.
GET /api/private Demonstrates how to protect an API route with the auth middleware.
GET /api/scope Demonstrates how to protect an API route with the can middleware.
GET /api/me Demonstrates how to make Management API calls.

Changes to the Default Laravel Application

This sample is based on the default Laravel application you can create using laravel new or composer create-project.

Note
For Laravel 10, use composer create-project laravel/laravel:^10.0 and follow the same steps outlined below.

Few changes are necessary to get started, as the SDK automatically sets up all the necessary guards, middleware and other services necessary to support authentication and authorization. The following is a list of changes that have been applied:

  • The auth0/login package has been added to the composer.json file, using:

    composer require auth0/login:^7.8 --update-with-all-dependencies
  • The config/auth0.php file was generated, using:

    php artisan vendor:publish --tag auth0
  • The routes/web.php file was updated to include the demonstration routes.

  • The routes/api.php file was updated to include the demonstration routes.

Feedback

We appreciate your feedback! Please create an issue in this repository or reach out to us on Community.

Vulnerability Reporting

Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.

What is Auth0?

Auth0 helps you to easily:

  • implement authentication with multiple identity providers, including social (e.g., Google, Facebook, Microsoft, LinkedIn, GitHub, Twitter, etc), or enterprise (e.g., Windows Azure AD, Google Apps, Active Directory, ADFS, SAML, etc.)
  • log in users with username/password databases, passwordless, or multi-factor authentication
  • link multiple user accounts together
  • generate signed JSON Web Tokens to authorize your API calls and flow the user identity securely
  • access demographics and analytics detailing how, when, and where users are logging in
  • enrich user profiles from other data sources using customizable JavaScript rules

Why Auth0?

License

This project is licensed under the MIT license. See the LICENSE file for more info.