Lumen vs sanctum vs passport

I understood, that Lumen is a framework with the focus on delivering amazing fast api's. Is this right?

Am I right, that everything what is provided by lumen, is also covered by laravel?

Thanks for the quick reply!

Cheers

This makes it clear, thanks @fylzero

@fylzero Obviously you have a lot of experience building different types of sites and apps. Can you give us a few examples of scenarios where Sanctum won't do and Oauth provides extra functionality?

@liama There really aren't multiple examples of what I'm describing.

Passport/Oauth2 basically gives your application the API and interface to allow users to create access tokens that allow third-party apps to communicate with the API of your Laravel application. So unless cross-application access is something you need, you can pretty much skip using Passport.

Definitely watch the Laracast video on Passport to gain a better understanding of what this does. Taylor Otwell actually connects two laravel apps using it in this video. https://laracasts.com/series/whats-new-in-laravel-5-3/episodes/13

The truth is, Passport is a bit complex because Oauth2 is complex. The Laravel docs certainly assume anyone using Passport has a solid foundational knowledge of Oauth2 imo. Without that, you won't have an understanding of what the terminology is around grant types, etc.

Sanctum is much simpler. It allows you to properly auth your SPA and create tokens for your API. That's really all it does. I say properly because up until Sanctum was released I would often see applications being created that just relied on logging a user in through Blade views then relying on web routes for the SPA code. This comes with a few challenges that Jess Archer laid out nicely in a Laracon talk (almost right before Sanctum was really a thing / released). https://www.youtube.com/watch?v=Zv4bUXEwl20

@fylzero Thank you for the thorough reply. I understand everything much better now.

Just one more question: Right now, the project I'm working on doesn't need to support 3rd part apps. In the future it might, but I can't tell for sure if and when that will be. Would using Sanctum now and then in the future (maybe) upgrade to Passport make sense?

@liama Unless you know your eventual product roadmap will call for something, I would not just pull random things in that might get used someday. Yes, technical debt is real... but, so is over-engineering.

That said, absolutely... you could always use Sanctum now and tear it out / replace it with Passport later.

If you ever need to do this, one trick I would use is creating a fresh Laravel install, Git init/commit the project, then install Sanctum. By doing this you can look in, for example, VS Code's source control and see the diffs of everything you'd need to walk back to uninstall it.

Sanctum is pretty much a composer package, a config, a migration, and a middleware entry in the Kernel file. It is not exceedingly difficult to remove from a project.

thank you once more for a very insightful reply