Fiton012's avatar

Bridge auth in Laravel and React SPA with sanctum

We are using a Laravel app that has bladed files (legacy) and we want to move this gradually in a Nodejs/React SPA (different instance than Laravel app). We doing this by routing in AWS Cloudfront the new links to the SPA.

In order for the authentication system to work for both the legacy and the SPA we used the Santum package. We've read the sanctum documentation and implemented it, however because of the nature of the system we have some kind of auth mis-alignments. ie The SPA apps keeps asking for a sanctum token since it does not know what is the state of the legacy app (auth or not auth). Even if we stops asking for one when we receive one then we don't know when a user logs out from the legacy one so that we invalidate the one that we have. So we need be to keep polling for a token on every page load but of course that increases server overhead.

I was wondering whether instead of having the SPA keep asking for the sanctum token naively from the Laravel maybe we can generate it during the normal authenticate (user,password) in Laravel and either store it in cookies (no http cookie) or via javascript in browser local storage. Then when I redirect to a SPA page it will just trying to find this auth token by reading the cookies or the browser local storage. If it finds it, I am authenticated if not, I am not.

Is this a good way of implementing the sanctum auth? Does anyone foresee any security issues with that??

0 likes
0 replies

Please or to participate in this conversation.