是否可以在Laravel的同一控制器上同时使用auth和auth：api中间件？

Question

I got the task to implement API for mobile using Laravel Passport (for OAUTH2 support). I want to reuse the same Controller methods (some of them) that I use on the website. I have tried doing this:

public function __construct()
{
    $this->middleware('auth');
    $this->middleware('auth:api');
}

But that doesn't work (why?). Do I just have to create new controllers for the api? Thanks!

Answer 1

In your routes file you can specify multiple middleware's by doing.

Route::middleware(['auth:api', 'auth'])->group(function() {
    //my routes
});

But it seems like for your use, you could just use auth:api in your api routes file and auth in your web routes file.

Additionally if you'd like to middleware the entire controller without grouping via routes you can use middleware groups.

In your Http Kernel.php add a new index to the array $middlewareGroups

protected $middlewareGroups = [
    'web' => [
        \App\Http\Middleware\EncryptCookies::class,
        \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
        \Illuminate\Session\Middleware\StartSession::class,
        \Illuminate\View\Middleware\ShareErrorsFromSession::class,
        \App\Http\Middleware\VerifyCsrfToken::class,
    ],

    'api' => [
        'throttle:60,1',
        'auth:api',
    ],

    'both' => [
        'auth:api',
        'auth'
    ],
];

Then in your controller you should be able to do:

public function __construct() {
    $this->middleware('both');
}

Additionally you can exclude methods within the controller from the middleware group.

public function __construct() {
    $this->middleware('both', ['except' => [ 'methodOne', 'methodTwo' ]]);
}

Answer 2

If you want to have 2 different Auth guards checking for a user you can do that with the auth middleware. It takes a unspecified number of parameters:

auth:web,api

That will check each guard for a user until one is returned then use that as the current guard for the request.

What you have are 2 different middleware being ran in the stack. Since only one of them will actually pass you are always 'unauthenticated' with your setup. (unless you have a session and are passing a token for some odd reason).

SO - Laravel two diffrent middleware authentication from auth middleware only

SO - Laravel multi auth protecting route multple middleware not working