Member Avatar for baig772

I am using passport in laravel for authenticating my users in APIs. I am able to authenticate different types of users from different tables and generating different token for them but the routes are not protected. For example.
A user can access the routes like this

Route::group(['middleware'  =>  'auth:api'], function () {
    Route::group(['prefix'  =>  'v1'], function () {
        Route::get('get-seller-list','API\v1\SellersController@index');
    });
});

and A doctor can access the routes like

Route::group(['middleware'  =>  'auth:sellers'], function () {
    Route::group(['prefix'  =>  'v1'], function () {
    Route::get('get-seller-detail','API\v1\TestController@getDetails');
    });
});

but this middleware check doesn't seem to be working as I can access all the routes for sellers even if I have passed the token generated for api in Bearer header.

My config/auth.php looks like

'guards' => [
        'user' => [
            'driver' => 'session',
            'provider' => 'users',
        ],

        'seller' => [
            'driver' => 'passport',
            'provider' => 'sellers',
        ],

        'admin' => [
            'driver' => 'session',
            'provider' => 'admins',
        ],

        'web' => [
            'driver' => 'session',
            'provider' => 'users',
        ],

        'api' => [
            'driver' => 'passport',
            'provider' => 'users',
        ],
    ],
  • 2 Contributors
  • 1 Reply
  • 1K Views
  • 3 Months Discussion Span
  • Latest Post Latest Post by PARDEEP_2

Dani AI

Generated

Short diagnosis: the auth middleware uses the exact guard name you pass (the part after the colon) and that name must match a guard key in config/auth.php. In the snippets posted by the guard is declared as seller but the route used auth:sellers (plural) — that kind of mismatch will bypass the guard you expect. Passport also supports defining a separate passport-based guard per provider, but the guard name has to match exactly. (laravel-doc.readthedocs.io)

Practical fixes (pick one):

  • Define a dedicated passport guard for sellers (e.g. api-sellers with provider sellers) and protect seller routes with that guard (auth:api-sellers). This makes Passport resolve the correct provider for the incoming token. (laravel.com)
  • Or keep one passport guard for token validation (e.g. auth:api) and add a small authorization middleware that checks the authenticated user is actually a seller (e.g. if ($request->user()->is_seller) ...). Register that middleware and apply ['auth:api','ensure.seller'] to seller routes — this is the approach shown in community answers. (stackoverflow.com)

Troubleshooting tips: after changing guards or middleware clear cached config/routes (php artisan config:clear, php artisan route:clear) so Laravel picks up the edits; re-generate tokens if you change which provider a grant uses. If problems persist, confirm the guard name strings in config/auth.php exactly match what you use in auth:<guard> middleware. (laravel.com)

Member Avatar for PARDEEP_2

I think you have problem in middleware routes so follow this article

Edited by PARDEEP_2
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.