Terminal

Overview Most developers reach for Laravel Breeze or Jetstream when they need authentication. While these starter kits are powerful, they often include more code than a specific project requires. Building a login and registration system from scratch using only Laravel and Blade gives you absolute control over the user experience and the underlying logic. This approach strips away the abstraction, allowing you to understand how Laravel's authentication guards, sessions, and request validation actually interact. Prerequisites To follow this tutorial, you should have PHP 8.2 or higher installed on your machine. You need a basic understanding of the MVC (Model-View-Controller) architecture and how Laravel handles routing. Familiarity with the Terminal for running Artisan commands and a local database setup (like SQLite) is also required. Key Libraries & Tools * **Laravel Framework**: The core PHP framework providing the auth facades and routing engine. * **Blade Templating**: Laravel's native templating engine for creating dynamic HTML forms. * **SQLite**: A lightweight, file-based database used for quick development and testing. * **PHPStorm**: The IDE used for writing and managing the codebase during this walkthrough. Code Walkthrough 1. Defining the Routes Everything starts in `routes/web.php`. You must define routes for displaying the forms and handling the post requests. Unlike starter kits, we explicitly name our routes to keep our Blade templates clean. ```python Route::get('/login', function () { return view('login'); })->name('login'); Route::post('/login', LoginController::class)->name('login.attempt'); Route::get('/dashboard', function () { return view('dashboard'); })->name('dashboard')->middleware('auth'); ``` 2. The Login Controller Laravel makes manual authentication remarkably simple through the `Auth::attempt` method. This method automatically handles password hashing comparisons and session creation. Note the use of `request()->regenerate()` to prevent session fixation attacks. ```python public function __invoke(Request $request) { $credentials = $request->validate([ 'email' => ['required', 'email'], 'password' => ['required'], ]); if (Auth::attempt($credentials)) { $request->session()->regenerate(); return redirect()->intended('dashboard'); } return back()->withErrors([ 'email' => 'The provided credentials do not match our records.', ]); } ``` 3. Registering New Users For registration, you manually hash the password before saving it to the database. Laravel's `bcrypt` helper ensures the password isn't stored in plain text. After creating the user, use `Auth::login($user)` to immediately authenticate the new account. ```python public function store(Request $request) { $userData = $request->validate([ 'name' => 'required|string', 'email' => 'required|email|unique:users', 'password' => 'required|min:8', ]); $userData['password'] = bcrypt($userData['password']); $user = User::create($userData); Auth::login($user); return redirect()->route('dashboard'); } ``` Syntax Notes * **Single Action Controllers**: Using the `__invoke` method allows a controller to handle exactly one route, making your logic modular and easy to find. * **Blade Directives**: The `@csrf` directive is non-negotiable for any POST request in Laravel. It generates a hidden token field that protects your application against cross-site request forgery. * **Validation Arrays**: Passing an array of rules to `$request->validate()` is the standard way to ensure data integrity before it touches your database. Practical Examples This custom approach is ideal for specialized applications. For instance, if you are building an internal company tool that requires login via a unique **Username** instead of an email, you can simply swap the validation key in the controller and the input type in the Blade file. This flexibility is much harder to achieve when fighting against the rigid structures of a pre-built starter kit. Tips & Gotchas * **The Session Trap**: Always remember to call `session()->invalidate()` and `session()->regenerateToken()` during the logout process. If you don't, you leave the user's session vulnerable to hijacking. * **Rate Limiting**: Use the `throttle` middleware on your login routes. Without it, your app is an open target for brute-force attacks. A simple `middleware('throttle:5,1')` limits users to five attempts per minute. * **Fillable Property**: If you add new fields like `username` to your database, you must update the `$fillable` array in your `User` model. Otherwise, Laravel's mass-assignment protection will silently discard the data.