Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

murilo's avatar
Level 10

/oauth/authorize Laravel passport with no session ( only with token )

hello , in Laravel , with Passport . we have a Autorization Method ( /outh/authorize ). A service (a Laravel Project 2 ) sends a authorization to other project ( Laravel Project 1 ) .

like this -

https://laravel.com/docs/11.x/passport#when-requesting-authorization-codes

with this code -

Route::get('/redirect', function () {
    $query = http_build_query([
        'client_id' => 'client-id',
        'redirect_uri' => 'http://example.com/callback',
        'response_type' => 'code',
        'scope' => 'place-orders check-status',
    ]);
 
    return redirect('http://passport-app.test/oauth/authorize?'.$query);

( Laravel project 2 sending to Laravel project 1 a Authorization Code );

my question is , the project that receives the authorization code (oauth/authorize ), it uses SESSION to check if -

  • user is logged in , returns the authorization code .
  • if is not logged in , returns and logg in , after logg in . turn back and send authorization code .

I wold like to do this withoute use session , having VUE js at front and laravel in Backend . the way it is , it needs to use session , and it cant separate front and backed .

to do that I will need to overite this method -

public function approve(Request $request)
    {
        $this->assertValidAuthToken($request);

        $authRequest = $this->getAuthRequestFromSession($request);

        $authRequest->setAuthorizationApproved(true);

        return $this->withErrorHandling(function () use ($authRequest) {
            return $this->convertResponse(
                $this->server->completeAuthorizationRequest($authRequest, new Psr7Response)
            );
        });
    }


wold be a good idea to do that ?

0 likes
3 replies
martinbean's avatar
Level 80

I wold like to do this withoute use session

@murilo You can’t. That’s literally the point of Passport (and OAuth): a user authorises access to resources. How does a user authorise access? Well, you need to authenticate that user first. The user needs to log in somewhere in order to say, “Yes, that client can access my data.”

murilo's avatar
Level 10

it wold be nice if could have a option to not use session and instead could use laravel passport to verify if the user is logged in or not .

1 like
bestiony's avatar

@murilo any progress ! I am stuck with a lot of errors. all of which because I am trying to use tokens instead of sessions

Please or to participate in this conversation.