Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

vjupix's avatar

Laravel Socialite with Laravel Passport Server Best Practices

So I have several Laravel Client Apps which all authenticate users against a central Laravel Passport oAuth Server. For this I use Laravel Socialite on the Client Apps with the Laravel Socialite Passport Provider: https://socialiteproviders.com/Laravel-Passport/

The oauth flow is working as expected. The user gets redirected to the Laravel Passport oAuth Server, authenticates and gets redirected back to the client app. The callback route then calls my LoginController's authenticate function on the Client Side App which looks like this:

class LoginController extends Controller
{
    public function authenticate()
    {
        try {
            $passportUser = Socialite::driver('laravelpassport')->user();
        } catch (Exception)
        {
            return redirect()->route('login');
        }
        Log::info('User authenticated: ' . json_encode($passportUser));
        $account = UserManager::getPassportAccountById($passportUser->id);

        if ($account) {
            $user = $account->user;
            $user->email = $passportUser->email;
            $user->id = $passportUser->id;

            $user->save();

            $account->token = $passportUser->token;
            $account->refresh_token = $passportUser->refreshToken;

            $account->save();
        } else {
            $account = new Account();
            $account->provider = 'passport';
            $account->id = $passportUser->id;
            $account->token = $passportUser->token;
            $account->refresh_token = $passportUser->refreshToken;

            $user = User::where('username', '=', $passportUser->user["username"])->first();

            if ($user) {
                $user->accounts()->save($account);
            } else {
                $user = $this->createUser($passportUser->id, $passportUser->user["username"], $passportUser->email);
                $user->accounts()->save($account);
            }
        }
        Auth::login($user);

        return redirect()->route('choose');
    }  

After a succesful oauth flow I see that Laravel Passport generated a new Access Token for the user. This token lasts for a year (Laravel Passport Default, changeable). Laravel's Session lasts 2 hours (per default, changeable).

Now the problem: If the user's session on the client app expires after 2 hours I need to redirect the user back to Laravel Passport so he can authenticate again and I can retrieve the user and authenticate him on the client app. Each time the user authenticates on the oAuth Server Laravel Passport creates a new access token for the user which also has a very long lifetime. If a user hits the login many times (several times a day, because his session on a client app timed out) this would create lots of access tokens on the Laravel Passport database. Like this: grafik.png

I am asking myself if this gets a problem and if this is expected behaviour? Are there any best practices I missed like configuring Passport Token Lifetime to be shorter or maybe match with the Laravel Session Lifetime? In my understanding Laravel Passport shouldn't generate new Access Tokens each time a user authenticates, instead it should look for an access token for that user and if it isn't expired return that instead. So each user should only have one valid access token per client app. This would make much more sense to me and I am not sure if I am missing something.

Also according to the Socialite Docs I could use this function, because I store the user's tokens/refresh tokens:

use Laravel\Socialite\Facades\Socialite;

$user = Socialite::driver('laravelpassport')->userFromToken($token);

The problem is: When a user's session timed out I don't know which user wants to authenticate and so I can't retrieve his token from the database to check if is still valid.

So how should one manage the Laravel Passport Access Tokens when using Laravel Socialite with the Passport Provider?

0 likes
0 replies

Please or to participate in this conversation.