Which OAuth 2.0 flow should I use? Vue form and API
Hello, I'm new to OAuth and APIs. I have set my Laravel API endpoints to store and send responses for saving a resource. In other webpage I have a Vue public form for users to buy tickets and store them in the Laravel app.
If I use passport, what type of authorization flow (why, benefits) I need to use to authenticate all requests to my API? Thank you.
The answer depends on how you plan to consume the API but it sounds like you want the users to login in the frontend which then queries your own backend. I would use the Password Grant type as its pretty simple - where the user supplies there username/password and if they are correct get a token back that they then use on subsequent requests.
Rather than trying to explain the differences between the types there is a good laravel news blog post on the subject
@D9705996 - Great answer, thank you.
The ticket form will be public and reachable by all guest users (eg domain.com/form), they will not need to login to fill and send the form. And my API will live on anotherdomain.com/api
Maybe I'm confused and is not the case to use authenticated API requests to my app because there is no login on the frontend... I thought on using authenticated requests to add some security to my API but maybe is not the use case here.
@D9705996 - That is what I’m looking for now, if I need to authenticate or not... how can I resolve this? Any more ideas? How to determine if I need authentication to send the form data or not...
@CHARRUA - This is a decision you need to decide yourself based on how you want your application to work. If you are happy that anyone can submit the form then you don;t need any authentication (I would recommend using something like reCaptcha to prevent automated scripts spamming you form.
There is a good lesson on laracasts on adding this.
If you do need user to login to be able to post the form then you will need an authentication workflow and if you are using passport the password grant should work well for you.