在 laravel 8 中创建 auth guard 使用中间件

Question

I want to create a new guard which will be used in creating api for the user, what i expected is middleware (auth: u-api), but it doesn't work and just redirect to login dashboard again doesn't show the json

how to show all users like this, without adding (auth: api)

{
    id: 1,
    role_id: "1",
    username: "adminuser",
    email: "admin@gmail.com",
    email_verified_at: "2021-02-22T06:02:02.000000Z",
    created_at: "2021-02-19T02:42:08.000000Z",
    updated_at: "2021-02-22T06:02:02.000000Z",
    logged_at: "2021-03-03T20:21:33.000000Z"
}

route/api.php

Route::middleware('auth:u-api')->get('/halo', function(Request $request){
    return $request->user();
});

Providers/RouteServiceProvider.php

    public function boot()
    {
        $this->configureRateLimiting();

        $this->routes(function () {
            Route::prefix('api')
                ->middleware('api')
                ->namespace($this->namespace)
                ->group(base_path('routes/api.php'));

            Route::prefix('u-api') // User API
                ->middleware('u-api')
                ->namespace($this->namespace)
                ->group(base_path('routes/api.php'));

            Route::middleware('web')
                ->namespace($this->namespace)
                ->group(base_path('routes/web.php'));
        });
    }

config/auth.php

'guards' => [
        'web' => [
            'driver' => 'session',
            'provider' => 'users',
        ],

        'api' => [
            'driver' => 'sanctum',
            'provider' => 'users',
            'hash' => false,
        ],

        'u-api' => [ // User API
            'driver' => 'session',
            'provider' => 'users',
        ],
    ],

app/Http/Kernel.php

class Kernel extends HttpKernel
{
    protected $middleware = [
        // \App\Http\Middleware\TrustHosts::class,
        \App\Http\Middleware\TrustProxies::class,
        \Fruitcake\Cors\HandleCors::class,
        \App\Http\Middleware\PreventRequestsDuringMaintenance::class,
        \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
        \App\Http\Middleware\TrimStrings::class,
        \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
    ];

    protected $middlewareGroups = [
        'web' => [
            \App\Http\Middleware\EncryptCookies::class,
            \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
            \Illuminate\Session\Middleware\StartSession::class,
            // \Illuminate\Session\Middleware\AuthenticateSession::class,
            \Illuminate\View\Middleware\ShareErrorsFromSession::class,
            \App\Http\Middleware\VerifyCsrfToken::class,
            \Illuminate\Routing\Middleware\SubstituteBindings::class,
        ],

        'api' => [
            \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
            'throttle:api',
            \Illuminate\Routing\Middleware\SubstituteBindings::class,
        ],

        'u-api' => [ // User API
            \App\Http\Middleware\EncryptCookies::class,     
            \Illuminate\Session\Middleware\StartSession::class,
            'throttle:api',
            \Illuminate\Routing\Middleware\SubstituteBindings::class,
        ]
    ];

    protected $routeMiddleware = [
        'auth' => \App\Http\Middleware\Authenticate::class,
        'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
        'cache.headers' => \Illuminate\Http\Middleware\SetCacheHeaders::class,
        'can' => \Illuminate\Auth\Middleware\Authorize::class,
        'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
        'password.confirm' => \Illuminate\Auth\Middleware\RequirePassword::class,
        'signed' => \Illuminate\Routing\Middleware\ValidateSignature::class,
        'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
        'verified' => \Illuminate\Auth\Middleware\EnsureEmailIsVerified::class,
        'role' => \App\Http\Middleware\CheckRole::class,
    ];
}

Answer 1

If you want an API without authentication, you could do something like this:

Route::get('/halo', function() {
    return User::all();
});

However, it would make it possible for anyone to enumerate all the user data.

So I'd add some form of authentication + authorization, just to keep those details accessible only to a specific user(s).

In the simplest form, it would look something like this:

Route::middleware('auth:api')->get('/halo', function() {
    if (Auth::user()->id !== 1) abort(403);
    return User::all();
});

You can also go for a role-based approach by using spatie/laravel-permission which would be much more flexible.