Laravel Sanctum adalah paket yang disediakan oleh Laravel untuk mengimplementasikan autentikasi API dengan menggunakan Token Authentication. Ini memungkinkan kita mengamankan API dan mengizinkan pengguna untuk mengaksesnya dengan aman.
Jika belum memiliki project, Buat projeck dengan perintah berikut:
composer create-project laravel/laravel example-appInstal dan Konfigurasi Laravel Sanctum
Langkah berikutnya adalah menginstal Laravel Sanctum dan mengonfigurasi proyek Laravel Kita untuk menggunakannya:
Install library sanctum pada projek kita:
composer require laravel/sanctum
php artisan vendor:publish --provider="Laravel\Sanctum\SanctumServiceProvider"
php artisan vendor:publish --tag=sanctum-migrations
php artisan migrateEdit file kernel berikut untuk mendaftarkan library pada file berikut => app/Http/Kernel.php:
'api' => [
\Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
\Illuminate\Routing\Middleware\ThrottleRequests::class.':api',
\Illuminate\Routing\Middleware\SubstituteBindings::class,
],Buat file AuthControler pada folder API yang akan menangani login,register dan logout user => App/Http/Controllers/API/AuthController.php
php artisan make:controller API/AuthController
php artisan route:clearEdit file config/auth.php dan tambahkan kategori api
'defaults' => [
'guard' => 'api',
'passwords' => 'users',
],
'guards' => [
...........
'api' => [
'driver' => 'sanctum', // Set the driver to 'sanctum'
'provider' => 'users',
'hash' => false,
],
],
'providers' => [
'users' => [
'driver' => 'eloquent',
'model' => App\Models\User::class,
]
],Edit file App\Http\Controllers\API/AuthController.php dan tambahkan kode jadi seperti dibawah ini:
<?php
namespace App\Http\Controllers\API;
use App\Http\Controllers\Controller;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;
use App\Models\User;
use Illuminate\Support\Facades\Validator;
use Illuminate\Support\Facades\Auth;
class AuthController extends Controller
{
public function register(Request $request)
{
$validator = Validator::make($request->all(), [
'name' => 'required|string|max:255|min:2',
'email' => 'required|string|email|max:255|unique:users',
'password' => 'required|string|min:6',
]);
if ($validator->fails()) {
echo $validator->messages()->toJson();
}else{
$user = User::create([
'name' => $request['name'],
'email' => $request['email'],
'password' => bcrypt($request['password'])
]);
$token = $user->createToken('myapptoken')->plainTextToken;
$response = [
'user' => $user,
'token' => $token
];
return response($response, 201);
//return JSON process insert failed
// return response()->json([
// 'success' => false,
// ], 409);
}
}
public function login(Request $request)
{
$fields = $request->validate([
'email' => 'required|string',
'password' => 'required|string'
]);
// Check email
$user = User::where('email', $fields['email'])->first();
// Check password
if (!$user || !Hash::check($fields['password'], $user->password)) {
return response([
'message' => 'Not AUthenticated'
], 401);
}
$token = $user->createToken('myapptoken')->plainTextToken;
$response = [
'user' => $user,
'token' => $token
];
return response($response, 201);
}
public function profile(Request $request)
{
$user = $request->user();
return response()->json([
'user' => $user,
]);
}
public function logout(Request $request)
{
$user = Auth::user();
if ($user) {
$user->tokens->each(function ($token, $key) {
$token->delete();
});
return response()->json(['message' => 'Logged out'], 200);
}
return response()->json(['message' => 'User not found'], 404);
}
}Menggunakan auth santum pada file contoller yang diproteksi:
Buat sebuah Migration, conntroller dan model
php artisan make:model Users -c -m
Setelah menjalankan artisan diatas maka akan diciptakan migration,model dan controller.
Modifikasi file database/migration/nama_migration.php
<?php
use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;
return new class extends Migration
{
/**
* Run the migrations.
*/
public function up(): void
{
Schema::create('users', function (Blueprint $table) {
$table->id();
$table->string('name');
$table->string('email')->unique();
$table->timestamp('email_verified_at')->nullable();
$table->string('password');
$table->rememberToken();
$table->timestamps();
});
}
/**
* Reverse the migrations.
*/
public function down(): void
{
Schema::dropIfExists('users');
}
};Modifikasi juga model user di app/models/User.php
<?php
namespace App\Models;
use Illuminate\Contracts\Auth\MustVerifyEmail;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Laravel\Sanctum\HasApiTokens;
class User extends Authenticatable
{
use HasFactory,HasApiTokens, HasFactory, Notifiable;
/**
* The attributes that are mass assignable.
*
* @var array<int, string>
*/
protected $fillable = [
'name',
'email',
'password',
];
/**
* The attributes that should be hidden for serialization.
*
* @var array<int, string>
*/
protected $hidden = [
'password',
'remember_token',
];
/**
* The attributes that should be cast.
*
* @var array<string, string>
*/
protected $casts = [
'email_verified_at' => 'datetime',
'password' => 'hashed',
];
}Modifikasi file controller di app/http/controllers/API/UsersController.php
<?php
namespace App\Http\Controllers\API;
use App\Http\Controllers\Controller;
use App\Models\User;
use Illuminate\Http\Request;
use Illuminate\Http\Response;
class UsersController extends Controller
{
public function __construct()
{
$this->middleware('auth:sanctum');
}
public function index(Request $request)
{
// $users = User::all();
// $dataResp=$request()->query('page');
$users = User::orderBy('id', 'desc')->limit(4)->get();
return response()->json([
'success' => true,
'data' => $users,
// 'resp' => $dataResp,
], 200);
}
public function show($id)
{
// Retrieve a single user by ID
$user = User::find($id);
if (!$user) {
return response()->json(['message' => 'User not found'], Response::HTTP_NOT_FOUND);
}
return response()->json($user);
}
public function store(Request $request)
{
// Create a new user
$user = User::create($request->all());
return response()->json($user, Response::HTTP_CREATED);
}
public function update(Request $request, $id)
{
// Update an existing user
$user = User::find($id);
if (!$user) {
return response()->json(['message' => 'User not found'], Response::HTTP_NOT_FOUND);
}
$user->update($request->all());
return response()->json($user);
}
public function destroy($id)
{
// Delete a user
$user = User::find($id);
if (!$user) {
return response()->json(['message' => 'User not found'], Response::HTTP_NOT_FOUND);
}
$user->delete();
return response()->json(['message' => 'User deleted']);
}
}Terakhir kita daftarkan routes di api.php
Route::prefix('v1')->group(function () {
// Public routes
Route::post('/register', [AuthController::class, 'register']);
Route::post('/login', [AuthController::class, 'login']);
Route::post('/logout', [AuthController::class, 'logout']);
Route::get('/profile', [AuthController::class, 'profile']);
// Protected routes
Route::middleware(['auth:sanctum'])->group(function () {
Route::get('/users', [UsersController::class, 'index']);
Route::get('/users/{id}', [UsersController::class, 'show']);
Route::post('/users', [UsersController::class, 'store']);
Route::put('/users/{id}', [UsersController::class, 'update']);
Route::delete('/users/{id}', [UsersController::class, 'destroy']);
});
});Sekarang kita sudah bisa memanggil API users dengan login terlebih dahulu untuk mendapatkan token.
Gunakan token untuk mengakses routes yang diproteksi.
