Larave框架通过sanctum进行API鉴权详解

'api' => [
    \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
    'throttle:api',
    \Illuminate\Routing\Middleware\SubstituteBindings::class,
],

use Laravel\Sanctum\HasApiTokens;
class User extends Authenticatable
{
    use HasApiTokens, HasFactory, Notifiable;
}

INSERT INTO `users` (`id`, `name`, `email`, `email_verified_at`, `password`, `remember_token`, `created_at`, `updated_at`)
VALUES
	(1, 'java0904', '2954245@qq.com', NULL, '', NULL, NULL, NULL);

Route::middleware('auth:sanctum')->get('/user', function (Request $request) {
    return $request->user();
});
Route::post('/tokens/create', function (Request $request) {
    $user = \App\Models\User::find(1);
    模拟登陆,此时，会将用户的session存储，但是实际通过API认证的时候，此处用不到
//    \Illuminate\Support\Facades\Auth::login($user);
    $token =$user->createToken($user->name);
    return ['token' => $token->plainTextToken];
})->withoutMiddleware('auth:sanctum');

curl -d '' http://127.0.0.1:8000/api/tokens/create
{"token":"7|ZbSuwu7UBDeQjvXx6iNUCcZJKsbSSO6nctMQLjDq"}

curl -H 'Authorization: Bearer 7|ZbSuwu7UBDeQjvXx6iNUCcZJKsbSSO6nctmqLjDq' http://local.app.com/api/user
{"id":1,"name":"java0904","email":"295424581@qq.com","email_verified_at":null,"created_at":null,"updated_at":null}

<?php
class RouteServiceProvider extends ServiceProvider
{
    public function boot()
    {
        $this->configureRateLimiting();
        $this->routes(function () {
            //routes/api.php这个路由文件里面的路由，默认都会使用api中间件，并且路由前缀是/api
            Route::prefix('api')
//                ->middleware(['api'])//这里是默认的中间件，默认只有一个
                //这里我加上了auth:sanctum这个中间件，作为全局使用，就不用为每个路由加上这个中间件了，但是获取token的路由，需要排除这个中间件
                ->middleware(['api','auth:sanctum'])
                ->namespace($this->namespace)
                ->group(base_path('routes/api.php'));
            //'routes/WEB.php'这个文件里面的路由，默认都会使用web这个中间件
            Route::middleware('web')
                ->namespace($this->namespace)
                ->group(base_path('routes/web.php'));
        });
    }
}

protected $middlewareGroups = [
        //web中间件
        'web' => [
            \App\Http\Middleware\EncryptCookies::class,
            \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
            \Illuminate\Session\Middleware\StartSession::class,
            // \Illuminate\Session\Middleware\AuthenticateSession::class,
            \Illuminate\View\Middleware\ShareErrorsFromSession::class,
            //这里需要格外注意，所有/route/web.php中的路由，如果是post请求，都会有csrfToken的验证，当然也可以手动给排除一些路由
            \App\Http\Middleware\VerifyCsrfToken::class,
            \Illuminate\Routing\Middleware\SubstituteBindings::class,
        ],
        //api中间件
        'api' => [
             \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
            'throttle:api',
            \Illuminate\Routing\Middleware\SubstituteBindings::class,
        ],
    ];

<?php
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;

Route::middleware('auth:sanctum')->get('/user', function (Request $request) {
    return $request->user();
});
Route::post('/tokens/create', function (Request $request) {
    $user = \App\Models\User::find(1);
    模拟登陆,此时，会将用户的session存储，但是实际通过API认证的时候，此处用不到
    //    \Illuminate\Support\Facades\Auth::login($user);
    $token = $user->createToken($user->name);
    return ['token' => $token->plainTextToken];
})->withoutMiddleware('auth:sanctum');
Route::post('/tokens/create2', function (Request $request) {
    //这里可以写自己的一些验证逻辑
    //用户来获取token，必须携带用户名和密码
    $password = $request->get("password");
    $username = $request->get("username");
    $user = \App\Models\User::where('password', $password)->where('username', $username)->first();
    if (!$user) {
        return [
            'code' => 500,
            'msg' => '用户名密码错误'
        ];
    }
    $token = $user->createToken($user->name);
    return ['token' => $token->plainTextToken];
})->withoutMiddleware('auth:sanctum');
//用来写使用session，不是前后端分离的用户登陆
Route::post('/login', function (Request $request) {
    //laravel内部的验证方式
    if (\Illuminate\Support\Facades\Auth::attempt([
        'username' => $request->get("name"),
        'password' => $request->get("password")])) {
        //登陆成功
        //保存session
    } else {
        //登陆失败
    }
})->withoutMiddleware('auth:sanctum');