How to Use Auth Guard in Laravel? (for Authentication & User Management)

Let’s say you’ve made a members-only website. Then you’ll need control over who gets access. Laravel’s Auth Guard is the fundamental mechanism that manages this user authentication process. It essentially acts as the gatekeeper for your routes and controllers.

This system defines how users are authenticated for each part of your application. So there’s both flexibility and robust security out of the box. Understanding and implementing Auth Guards correctly is essential for protecting sensitive resources.

This blog showcases how to use Auth Guard in Laravel, along with additional tips and some mistakes to avoid. So let’s get into it.

What is Auth Guard in Laravel?

At its core, an Auth Guard is a mechanism that defines how users are authenticated for each request. In simpler terms, an Auth Guard answers the fundamental question:

“How do I get the user’s credentials, and where do I check them?”

It covers the entire logic for user authentication. That is, from fetching the user data from your chosen storage (like a database via Eloquent, or an API) to managing the user’s session state.

How Does an Auth Guard Work?

The process can be broken down into a straightforward, step-by-step flow:

1. Initial Request: A user attempts to access a protected route, like /dashboard.
2. Guard Intervention: Laravel’s authentication system triggers the specified Auth Guard (e.g., the default web guard).
3. Credential Check: The guard retrieves the user’s identifying token. This is most commonly:
   • A Session Guard looks for a session cookie, finds the stored user ID, and fetches the corresponding user model from the database.
   • An API Guard (like sanctum or passport) looks for an API token in the request headers.
4. Authentication Decision:
   • If Valid: The guard loads the complete user model and considers the request “authenticated.” The user proceeds to the dashboard.
   • If Invalid: The guard denies access, and the user is redirected to the login page or receives an unauthorized HTTP response.

This abstraction allows you to have different authentication methods for different parts of your application seamlessly.

For example, your web users can be authenticated via sessions, while the mobile app users are authenticated via API tokens. It’s all done within the same Laravel project.

Why Use Auth Guard in Laravel?

Laravel Auth Guards are more than just a technical requirement. They are a strategic tool for building flexible and secure applications. Here are the primary reasons to leverage them:

Handling Multiple User Roles (e.g. Admin, Blogger, Writer)

Easily manage distinct authentication for different user roles—like admins, bloggers, and customers. Do all that from separate database tables within a single application.

API vs Web Authentication

Use a session-based guard (like web) for your browser-based users. A token-based guard (like sanctum) will be suitable for your mobile or third-party API consumers.

Improved App Security and Control

Auth Guards provide a centralized, standardized way to enforce authentication. This reduces security gaps and gives you precise control over how each part of your app is protected.All in all, using Auth Guards are critical for authentication, which is a key part of securing Laravel applications.opment agency. Their experience can help you design a secure authentication system tailored to your specific needs.

Prerequisites & Setup Requirements for Laravel Auth Guard

Before implementing custom Auth Guards, ensure your development environment is correctly prepared. This foundational setup is crucial for a smooth authentication workflow.

Laravel Version & Dependencies

A basic Laravel installation includes the core authentication components. Ensure you are using a supported Laravel version (8.x or later is recommended). The necessary classes are part of the laravel/framework package.

So no additional installation is typically required for standard session-based guards.

Database & .env Configuration

Laravel’s default authentication relies on a database to store user records.

Step 1: Configure Your Environment: Verify your database connection details in the .env file are correct.

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=your_database_name
DB_USERNAME=your_username
DB_PASSWORD=your_password

Step 2: Run Migrations: Execute the default migration to create the users table.

php artisan migrate

Use Starter Kits (Breeze or Jetstream) (Optional)

For a rapid start, especially if you need a full UI for login and registration, consider using Laravel’s official starter kits:

• Laravel Breeze provides a minimal, simple implementation of Laravel’s authentication features, including controllers and Blade templates. It’s an excellent choice for learning.
• Laravel Jetstream offers more robust features, like two-factor authentication, team management, and support for Livewire or Inertia.js.

These kits automatically configure the default web guard and its routes, saving you initial setup time.

How to Use Auth Guard in Laravel?

This guide walks you through creating and using a custom Laravel Auth Guard. For this example, we’ll create an admin guard to separate administrator authentication from regular web users.

Step 1: Configure Guards and Providers

All authentication guards are defined in config/auth.php. We’ll add a new guard that uses the session driver and a new admins provider.

'guards' => [
    'web' => [
        'driver' => 'session',
        'provider' => 'users',
    ],
    'admin' => [ // Our new guard
        'driver' => 'session',
        'provider' => 'admins',
    ],
],
'providers' => [
    'users' => [
        'driver' => 'eloquent',
        'model' => App\Models\User::class,
    ],
    'admins' => [ // Our new provider
        'driver' => 'eloquent',
        'model' => App\Models\Admin::class,
    ],
],

Strengthen role-based access and handle permissions for complex applications by using best practices for advanced user management in Laravel.

Step 2: Create Models and Migrations

Create an Admin model and its corresponding migration. The structure will be similar to the default User model.

php artisan make:model Admin -m

In the migration file (e.g., create_admins_table), ensure it includes the essential authentication fields.

// In the migration's up() method
Schema::create('admins', function (Blueprint $table) {
    $table->id();
    $table->string('name');
    $table->string('email')->unique();
    $table->string('password');
    $table->rememberToken();
    $table->timestamps();
});

Run the migration: php artisan migrate.

Step 3: Define User Providers

This step is already handled in Step 1. By defining the admins provider and linking it to the Admin model, we’ve instructed the admin guard to use the admins database table for authentication.

Step 4: Create Middleware for Auth Guards

Laravel includes built-in middleware. To protect routes for our admin guard, we use the auth middleware with a guard parameter.

You can create a dedicated middleware for redirects, but often the built-in one suffices.

Step 5: Apply Middleware to Routes and Controllers

Protect your admin routes by specifying the guard in the middleware.

In routes/web.php:

// Public admin login route
Route::get('/admin/login', [AdminController::class, 'showLoginForm']);
// Protected admin routes
Route::middleware(['auth:admin'])->group(function () {
    Route::get('/admin/dashboard', [AdminController::class, 'dashboard']);
});

Step 6: Set Up Controllers and Authentication Logic

In your AdminController, use the admin guard with Laravel’s built-in Auth facade.

use Illuminate\Support\Facades\Auth;
public function authenticate(Request $request)
{
    $credentials = $request->validate([
        'email' => 'required|email',
        'password' => 'required',
    ]);
    // Specify the 'admin' guard
    if (Auth::guard('admin')->attempt($credentials)) {
        $request->session()->regenerate();
        return redirect()->intended('/admin/dashboard');
    }
    return back()->withErrors(['email' => 'The provided credentials are incorrect.']);
}
public function dashboard()
{
    // Get the authenticated admin user
    $admin = Auth::guard('admin')->user();
    return view('admin.dashboard', compact('admin'));
}

Step 7: Set Up Views and Routes for Different Guards

Create separate Blade views (e.g., admin/login.blade.php, admin/dashboard.blade.php). In the login form, ensure the form action points to your admin authentication route.

Step 8: Handle Exceptions and Redirects

You can customize the redirect path for unauthenticated users in app/Exceptions/Handler.php. To differentiate between guards, check the guard in the request.

Alternatively, define the redirect path for the admin guard in app/Providers/RouteServiceProvider.php:

public const HOME = '/dashboard';
public const ADMIN_HOME = '/admin/dashboard'; // Custom home for admin

Step 9: Run and Test the Application

1. Seed an admin user into the admins table using Tinker or a seeder.

php artisan tinker
>>> App\Models\Admin::create(['name' => 'Admin', 'email' => 'admin@example.com', 'password' => Hash::make('password')]);

2. Start your development server: php artisan serve.

3. Navigate to /admin/login and test the login.

4. Verify that accessing /admin/dashboard without logging in redirects you to the login page.

That’s it. You’ve successfully implemented a separate, secure authentication layer for administrators in your Laravel application.For in-depth expertise, consider consulting with a Laravel development agency. Their experience can help you design a secure authentication system tailored to your specific needs.

What are the Additional Tips to Use Auth Guard in Laravel?

While the core steps of configuring guards, providers, and middleware provide a solid foundation, here are some additional tips to improve your use of Auth Guard in Laravel applications:

1. Guard Fallbacks and Providers

By default, Laravel uses the currently active guard for authentication checks. However, you can define fallback guards in config/auth.php. If the primary guard fails to authenticate a user, Laravel attempts authentication with the fallback guard(s). This is useful for scenarios with multiple authentication methods (e.g., session-based for web and token-based for API).

2. User Serialization

When storing authenticated user information in the session, Auth Guard in Laravel serializes the user model by default. You can customize this behavior by defining a serialized method within your user model class. This allows you to control which user attributes are included in the serialized data for security purposes.

3. RememberMe Functionality

Laravel Auth Guard offers “remember me” functionality. It allows users to stay logged in for a specific period even after closing the browser. You can enable this functionality within your login controllers and configure the cookie behavior in config/auth.php.

4. Gates and Policies

For advanced access control beyond routes and controllers, there are Laravel gates and policies. Gates defines authorization logic based on user roles or permissions, while policies summarize this logic for specific models or resources. This allows for a more granular approach to restricting access within your application.

5. Custom Authentication Drivers

Laravel offers flexibility by allowing you to create custom authentication drivers. This enables you to integrate with external authentication services. You can even implement unique Laravel authentication mechanisms that don’t fit the standard session or token-based approaches.

Thus, by mastering these additional tips, you can leverage Auth Guard to build secure Laravel applications with granular access control.

Let’s Conclude

Laravel Auth Guard is fundamental to building secure, professional web applications. With Auth Guard, you can create structured, multi-layered authentication.

It helps provide precise control needed to cleanly separate user types like customers and administrators. Plus, you can manage distinct web and API authentication flows. Ultimately, using Auth Guards in Laravel ensures the application remains organized, secure, and scalable.

Keen to implement secure authentication in your Laravel project? Our team of Laravel developers for hire can assist you with every step of the process.

FAQs About Auth Guard in Laravel

Mayur Upadhyay

Leading digital transformation projects with precision and creativity, Mayur turns complex ideas into results-driven web solutions. As Project Leader at WPWeb Infotech, he leverages his expertise in Laravel, PHP, Shopify, and Drupal to deliver innovation, scalability, and long-term success.