Laravel 中间件 - 跳过护照验证

Question

We have 2 auth middlewares applied to specific routes, 'external_token' and 'auth:api'. When an external bearer token is presented we inspect it, and if all the values are good we consider the user authorized to access the requested url.

How do we process all other middlewares except passport auth?

public function handle(Request $request, Closure $next)
{
    $token = $request->header('Bearer');

    try {

        list($JWTHeader, $JWTPayload) = JWT::verify($token, JWT::TYPE_ID_EXTERNAL);

        $this->user = User::where('external_id', $JWTPayload['external_id'])->first();

        // Can we just set $this->user and process all other middlewares except auth?

    } catch (Exception $e) {

        Log::debug($e);
    }

    $response = $next($request);

    return $response;
}

Answer 1

Well, one thing you could do would be to set the user on the api guard, so when the auth middleware runs, it'll find the user you provided. You would have to ensure that your external_token middleware runs first.

auth()->guard('api')->setUser($this->user);

Another option would be to convert your external_token middleware into a Laravel auth guard so that you can use the built-in auth functionality. Then, you can protect your route with auth:api,external_token , and the auth will pass if any one of the specified guards is successful.

The simplest example would be a closure request guard .

In your AuthServiceProvider::boot() method:

// don't forget your "use" statements for all these classes

public function boot()
{
    // ...

    Auth::viaRequest('external_token_driver', function ($request) {
        $token = $request->header('Bearer');

        try {
            list($JWTHeader, $JWTPayload) = JWT::verify($token, JWT::TYPE_ID_EXTERNAL);

            return User::where('external_id', $JWTPayload['external_id'])->first();
        } catch (Exception $e) {
            Log::debug($e);
        }

        return null;
    });
}

In your auth.php config:

'guards' => [
    // web, api, etc...

    'external_token' => [
        'driver' => 'external_token_driver',
    ],
],

NB: all untested.