Laravel Passport - Store token in cookies

As far as I know your cookie should only be there for reading purposes and not for something else. You need to extract the value to send it along as the header.

An alternative option is overriding the auth:api middleware with your own check on the cookie instead of the header.

Here is also an tutorial on how to properly set up an API with passport being very secure: http://esbenp.github.io/2017/03/19/modern-rest-api-laravel-part-4/

@BOBBYBOUWMANN - What is involved in overriding the auth:api middleware?

Would I have to create a new class that implements Guard? I see Auth/Middleware/Authenticate has an authenticated() function that runs guard()->check().

Ideally I just need to swap checking Headers: Authorization for checking Cookies for the token instead.

Hopefully there's a way to do that without having to write a Guard from the ground up?

Laravel comes by default with the Authenticate middleware. In there you should be able to check on the cookie and perform some check on the user if it's authenticated or not.

Or simply convert the cookie to a header in your middleware

// app\Http\Middleware\Authenticate.php

public function handle($request, Closure $next, ...$guards)
{
    if ($request->cookie('cookie-name')) {
        $request->headers->set('Authorization', 'Bearer ' . $request->cookie('cookie-name'));

    }

    $this->authenticate($request, $guards);

    return $next($request);
}

Note: I didn't test this but it should point you in the right direction!

A lot had to be tweaked and tested afterward, but that solution was perfect for me. I moved it to a middleware that runs globally on every request so authentication is left as it is out of the box.

It's rare you get exactly what you were looking for! Thanks a lot @bob

@tomspeak No problem ;) I've been in this situation as well hehe

@BOBBYBOUWMANN - Have you encountered any issues further down the road?

I feel like I am potentially abusing Passport and using it as a pseudo-session storage as I am the only, first class, consumer of the API. I am only doing it so I can use React instead of Blade templates.

I damn near went for just using sessions as normal but with an entirely React front-end.

So far no problems. If authentication works fine than the only thing that remains are the api routes ;)

@tomspeak I followed a set of tutorial videos by Andre Madarang that included connecting to a Laravel API from a Vue front-end.

https://www.youtube.com/playlist?list=PLEhEHUEU3x5q-xB1On4CsLPts0-rZ9oos

Because it's about Vue, there's only about 3 videos in the series that deal directly with the Laravel API ... and I know it's Vue rather than React ... but the concepts will be similar ...

You might find them useful to review.

Now, Laravel Passport natively supports cookie-based authentication for JS apps. https://laravel.com/docs/8.x/passport#consuming-your-api-with-javascript