Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.
Hi,
I'm having trouble getting a Login page to work with Middleware to accept a username or email with Laravel 5.
Any chance on making a lesson about custom Authentication ?
or Is there an easy guide to follow ?
@itbuff Can you explain in more detail how you’re trying to authenticate a user via middleware?
Usually you would have middleware to detect if the user is authenticated or not, rather than put the authentication logic itself in there—that would usually live within a controller method.
Maybe not the best way, but you could check if the given identifier contains an @ (of cause only if it isn't allowed as part of the username), and check either for the username or email?
@mstnorris Yeah something like that ;) But you should probably have tagged @itbuff, since asked the question :P
@martindilling Oops, apologies ;) -> corrected
My first attempt which is all successful is not using the controller, rather just using the route file for example:
//region Authenticated Routes
Route::group(['middleware' => 'auth'], function()
{
Route::get('feeds', ['uses' => 'PagesController@feeds' , 'as' => 'feeds']);
Route::get('events', ['uses' => 'EventsController@index' , 'as' => 'events']);
Route::get('coc', ['uses' => 'PagesController@coc' , 'as' => 'coc']);
Route::get('chat', ['uses' => 'PagesController@chat' , 'as' => 'chat']);
This works fine.
My problem is I am having a hard time finding an easy way to accept another field within the login.blade.php like username.
I can't find the validation methods and if you give me its location, can you also include a little sample to create my own class so as not to change Laravel's default methods.
Here are the detail steps I have taken so far:
in the create_user_table migration file:
$table->string('username')->unique();
in the User.php model
protected $fillable = ['name','username', 'email', 'password'];
add to the register.blade.php username:
<input type="text" class="form-control" name="username" value="{{ old('username') }}">
in the default registrar.php Service add the username:
public function create(array $data)
{
return User::create([
'name' => $data['name'],
'email' => $data['email'],
'username' => $data['username'],
'password' => bcrypt($data['password']),
]);
}
create a middleware
php artisan make:middleware MyMiddleware
The code for the middleware:
<?php namespace App\Http\Middleware;
use Closure;
class MyMiddleware
{
public function handle($request, Closure $next)
{
return Auth::onceBasic('username') ?: $next($request);
}
}
In the kernel.php file add:
'myauth' => 'App\Http\Middleware\MyMiddleware',
Use MyMiddleware in routes.php:
Route::get('action', ['uses' => 'ActionController@index','middleware'=>'myauth']);
Route::post('action/create', ['uses' => 'ActionController@store','middleware'=>'myauth']);
I still cannot get the login.blade to work with validation for a username or email instead of just email.
Ok I worked out an easy solution. not sure if it's the correct way, but it definitely works the way I want it.
cp vendor/laravel/framework/src/Illuminate/Foundation/Auth/AuthenticatesAndRegistersUsers.php app/MyAuthAndRegistersUsers.php
public function postLogin(Request $request)
{
$this->validate($request, [
'username' => 'required', 'password' => 'required',
]);
$credentials = $request->only('username', 'password');
if ($this->auth->attempt($credentials, $request->has('remember')))
{
return redirect()->intended($this->redirectPath());
}
return redirect($this->loginPath())
->withInput($request->only('username', 'remember'))
->withErrors([
'username' => $this->getFailedLoginMessage(),
]);
}
use app/MyAuthAndRegistersUsers
class AuthController extends Controller {
use MyAuthAndRegistersUsers
// . . .
}
<input type="username" class="form-control" name="username" value="{{ old('username') }}">
/**
* Show the application login form.
*
* @return \Illuminate\Http\Response
*/
public function getLogin()
{
return view('auth.mylogin');
}
So not to make my original question a circular conversation, I could not find a way in Laravel 5 to login using a username. The validation for the login form happens to reside within the middleware logic. Hence the way provided above was my only working solution.
If someone can share an insight to a better method to authenticate a user using a custom field like username without raising more questions please provide a working solution.
I didn't think my question was so complicated.
The easiest way is following, using @itbuff answer. Let's call input for username or email field: 'username'.
In AuthController you must override two methods from traits:
protected function getCredentials(Request $request)
{
$field = filter_var($request->input('username'), FILTER_VALIDATE_EMAIL) ? 'email' : 'username';
$request->merge([$field => $request->input('username')]);
return $request->only($field, 'password');
}
public function loginUsername()
{
return 'username';
}
So far so good, but what if we want to handle the situation that we need a social login and username/email login via login form submit. I'm curious about the database model. By default the email field is unique and username field need to be unique too. But when the user choose to register with Facebook you will get the email address but no username or you will get the username (not sure what the Facebook and Google + APIs returns) but it may conflicts with other "login with" services like Google+. Can you share your toughs about this case...
Thanks
@1stonlinesolutions If you want to allow login from either email or username (or something else); use a login input field which is general.
$auth_by = (str_contains($request->login, '@')) ? 'email' : 'username';
$this->auth->attempt([
$auth_by => $request->login,
'password' => $request->password,
], $request->has('remember'));
@bashy my question was what will be the implementation in the database in situation when you want to offer login with email and/or username. I just did some tests and I found a solution.
Tested with mysql
| id | email | username | comment | | ------------- | ----------- | ----------- | ----------- | | 1 | u1@ex.com | NULL | user registered with FB login | | 2 | u2@ex.com | NULL | user registered with G+ login | | 5 | u3@ex.com | u3 | user registered manually (email and username are required) | | 6 | NULL | u4 | just a test | | 7 | NULL | NULL | another test, you probably do not want to have such users at your database :) |
Hope that will be helpful to someone.
@1stonlinesolutions Oh I thought you were already using unique for both. Anything that is used for login needs to be unique.
@bashy I thought that there will be conflicts between many nulls and the uniqueness but it's working. Something new learned today... Thanks!
i create middleware for admin role using following code
php artisan make:middleware AdminMiddleware
after that i create route for login page
Route::get('admin/login',['middleware'=>'web','as'=>'admin.login','uses'=>'AdminController@loginView']);
Route::post('admin/login',['middleware'=>'web','as'=>'admin.login','uses'=>'AdminController@login']);
Route::group(['prefix'=>'admin','middleware' => ['auth.admin','web']], function(){
Route::get('/', ['as'=>'admin.home','uses'=>'AdminController@index']);
Route::get('/home', ['as'=>'admin.home','uses'=>'AdminController@index']);
});
in controller
class AdminController extends Controller{
//
function index(){
return 'welcome';
}
function loginView(){
return view('admin.login');
}
function login(Request $request){
$error = $this->validate($request, [
'email' => 'required|email',
'password' => 'required|min:5',
]);
$email = $request->input('email');
$password = $request->input('password');
$remember = $request->input('remember');
if (Auth::attempt(['email' => $email, 'password' => $password,'type'=>'admin'], $remember)) {
// Authentication passed...
Auth::login(Auth::user(), $remember);
return redirect()->route('admin.home');
}else{//('message', 'Login Failed')
return redirect()->route('admin.login')->withErrors($request->all(), "message")->withInput();
}
}
}
and in AdminMiddleware
public function handle($request, Closure $next)
{
var_dump(Auth::user());
if(!Auth::check()){
return redirect()->route('admin.login')->withErrors('You are not logged in');
}elseif ($request->user()->type != 'admin'){
dd($request->user());
return redirect()->route('admin.login')->withErrors('You have not authority');
}
return $next($request);
}
in kernel.php
protected $routeMiddleware = [
'auth.admin' => \App\Http\Middleware\AdminMiddleware::class,
'auth' => \App\Http\Middleware\Authenticate::class,
'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
];
the error is i get alwys null for each $request->user() or Auth:user in AdminMiddleware
i found the solution in http://stackoverflow.com/a/35365533/3346472
Thanks everyone for the input, really appreciate the feedback.
I'll post the code used on gist or git in this thread in a couple of weeks for Laravel 5.2.
My next hurdle is authenticating oAuth for World of Warcraft and similar games, wish Jeffrey had a lesson on that, the documentation is so long... If(when) I succeed with that I might write a little package that simplifies oAuth authentication for Laravel, unless one already exists.
Well, You are not supposed to edit any vendor files. So why don't you override the methods from the class "AuthenticatesUsers" that is a trait in LoginController.
Just Override these methods below as :
protected function validateLogin(Request $request)
{
$field = filter_var($request->input('login'), FILTER_VALIDATE_EMAIL) ? 'email' : 'mobile';
$request->merge([$field => $request->input('login')]);
$this->validate($request, [
$field => 'required', 'password' => 'required',
]);
}
protected function credentials(Request $request)
{
$field = filter_var($request->input('login'), FILTER_VALIDATE_EMAIL) ? 'email' : 'mobile';
return $request->only($field, 'password');
}
And DONT forget to rename the field from default email to login in login.blade.php
You have to return
return $next($request);
even if your conditional fails so the next middleware can have the request. Same was used on Walmartone portal. If you move that outside the conditional if, that should fix your problem.
Your code should look like this:
class VerifyAdmin
{
public function handle($request, Closure $next, $guard = null)
{
if (Auth::user()->username == "enayet123") {
// Do the thing you want ... (return or redirect to somewhere else)
redirect()->route('homepage');
}
return $next($request);
}
}
You should always return $next($request) which is necessary to pass the code / request from a particular middleware.
You have to return
return $next($request);
even if your conditional fails so the next middleware can have the request. Same was used on. If you move that outside the conditional if, that should fix your problem.
Your code should look like this:
class VerifyAdmin { public function handle($request, Closure $next, $guard = null) { if (Auth::user()->username == "enayet123") { // Do the thing you want ... (return or redirect to somewhere else) redirect()->route('homepage'); } return $next($request); } }
You should always return $next($request) which is necessary to pass the code / request from a particular middleware.
. .. . . . . Thanks for this
Please or to participate in this conversation.