Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

d.bviens's avatar

Bypassing Auth in Laravel

I'm trying to bypass the password and database verifications for the authentication. I want bypass this because I will use Socialite in production but for local developement, I want to use any username I want.

I tried to use Auth::login() and pass it a new dummy user but it doesn't seems to stick in the session.

I tried to extend SessionGuard but I can't manage to create a working instance because I need a UserProvider and a Session Provider.

I feel I want to do the simplest thing ever but can't manage to do it. I'm sure there is a lot of way to do this so I'm open with any kind of solution.

Again, I just want to bypass Auth verifications and force a user with a name in the session.

Thank you

0 likes
6 replies
ismaile's avatar

@tomchabo If you haven't tried it yet, you can do something like this:

$user = App\Models\User::firstOrCreate([
        'name' => 'TestUser',
        'email' => '[email protected]',
        'password' => Hash::make('secretpass'),
    ]);
    Auth::login($user);

Please make sure you don't forget the relevant imports

d.bviens's avatar

Thank you for the reply. I was looking to not use the database at all but I very much can use it like this if ever I don't find something better.

ismaile's avatar
ismaile
Best Answer
Level 30

@tomchabo In this case, here is your solution, you can add the following code in the boot method of AppServiceProvider for example :

if (config('app.env') === 'local') {
    $user = \App\Models\User::newModelInstance([
        'name' => 'OtherTestUser',
        'email' => '[email protected]',
        'password' => Hash::make('secretpass'),
    ]);
    Auth::login($user);
}

Please note the usage of firstOrNew, this would create a User object without persisting it in the database. Besides, the code is wrapped inside an if to make sure it is run only in the local environment: we don't want people to login like this in production.

FInally, I suggested to put the code in the boot method of AppServiceProvider since it is run in every request. You can put the code elsewhere if you prefer.

2 likes
d.bviens's avatar

Thank you. It is perfect for my needs.

1 like
ismaile's avatar

I'm happy to help. By the way, newModelInstance is more appropriate than firstOrNew in your case. I updated the answer to reflect that.

1 like

Please or to participate in this conversation.