In this section, we will focus on implementing user authentication through Bcrypt password hashing. This is essential for securing user data and ensuring that only authorized users can access sensitive information.
We'll discuss this topic in this and the next units. This unit solely focuses on the model and database setup, as well as defining routes for registration and login. In the next unit, we'll implement the controller and views to complete the authentication process and protect routes that require authentication.
Let's start by setting up the database and creating the necessary models.
We start by defining the model for the user. This model will be used to interact with the database and manage user data:
// app/app/Models/User.php
<?php
namespace App\Models;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Illuminate\Database\Eloquent\Factories\HasFactory;
class User extends Authenticatable
{
use HasFactory, Notifiable;
protected $fillable = ['username', 'password'];
protected $hidden = ['password'];
}
The User model extends the Authenticatable class, which provides the necessary methods for user authentication. The fillable property specifies the fields that can be mass-assigned, while the hidden property specifies the fields that should be hidden when the model is serialized.
Next, let's define the migration for the users table:
// app/database/migrations/2014_10_12_000000_create_users_table.php
<?php
use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;
class CreateUsersTable extends Migration
{
public function up()
{
Schema::create('users', function (Blueprint $table) {
$table->id();
$table->string('username')->unique();
$table->string('password');
$table->timestamps();
});
}
public function down()
{
Schema::dropIfExists('users');
}
}
This migration creates a users table with columns for id, username, password, and timestamps.
Finally, let's define the controller and routes for user registration and login:
// app/app/Http/Controllers/UserController.php
<?php
namespace App\Http\Controllers;
use App\Models\User;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Hash;
class UserController extends Controller
{
public function register(Request $request)
{
$request->validate([
'username' => 'required|unique:users,username',
'password' => 'required|min:6',
]);
$user = User::create([
'username' => $request->username,
'password' => Hash::make($request->password),
]);
Auth::login($user);
return response()->json(['message' => 'User registered successfully'], 201);
}
public function login(Request $request)
{
$request->validate([
'username' => 'required',
'password' => 'required',
]);
if (Auth::attempt($request->only('username', 'password'))) {
return response()->json(['message' => 'Login successful'], 200);
}
return response()->json(['message' => 'Invalid credentials'], 401);
}
}
Let's examine both methods in the UserController:
- The
register method validates the request data, creates a new user with the hashed password, logs in the user, and returns a success message.
- The
login method validates the request data, attempts to authenticate the user, and returns a success message if successful or an error message if the credentials are invalid. The Auth::attempt method is used to authenticate the user. If the user is successfully authenticated, the method returns true, and the user is logged in. Note, that Auth::attempt automatically hashes the password before comparing it to the hashed password stored in the database - and it works with the table column names username and password by default. An alternative approach is to take the user with the provided username and then use the Hash::check method to compare the provided password with the hashed password stored in the database like so:
$user = User::where('username', $request->username)->first(); // get the user with the provided username
Hash::check($request->password, $user->password); // returns true if the passwords match
Additionally, its important to know that Laravel uses Bcrypt under the hood through its Hash facade. By default, Bcrypt is configured with a cost factor of 10 (2^10 rounds or 1024 iterations), which balances security and performance. You can adjust the cost factor in Laravel's config/hashing.php file.
'driver' => 'bcrypt',
'bcrypt' => [
'rounds' => env('BCRYPT_ROUNDS', 10),
]
Rounds: The number of iterations Bcrypt performs during hashing. Increasing this value increases the time required to hash (and verify) a password. Bcrypt applies a unique salt to every password, so even if two users have the same password, their Bcrypt-hashed passwords will be entirely different due to the salt.
Finally, the routes for user registration and login are defined in the routes/web.php file:
// app/routes/web.php
<?php
use Illuminate\Support\Facades\Route;
use App\Http\Controllers\UserController;
Route::get('/register', function () {
return view('register');
});
Route::get('/login', function () {
return view('login');
});
Route::post('/register', [UserController::class, 'register']);
Route::post('/login', [UserController::class, 'login']);
Notice, that we have defined routes for /register and /login that render the register and login views respectively. The routes for user registration and login are defined as POST requests that are handled by the register and login methods in the UserController.
Let's additionally take a look at the views for user registration and login:
<!-- resources/views/register.blade.php -->
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Register</title>
</head>
<body class="bg-gray-100">
<div class="container mx-auto mt-10">
<div class="max-w-md mx-auto bg-white p-5 rounded shadow">
<h2 class="text-2xl mb-4">Register</h2>
<form action="/register" method="POST">
@csrf
<div class="mb-4">
<label for="username" class="block text-sm font-medium text-gray-700">Username</label>
<input type="text" name="username" id="username" class="mt-1 block w-full border-gray-300 rounded-md shadow-sm" required>
</div>
<div class="mb-4">
<label for="password" class="block text-sm font-medium text-gray-700">Password</label>
<input type="password" name="password" id="password" class="mt-1 block w-full border-gray-300 rounded-md shadow-sm" required>
</div>
<div class="mb-4">
<button type="submit" class="bg-blue-500 text-white px-4 py-2 rounded">Register</button>
</div>
</form>
</div>
</div>
</body>
</html>
<!-- resources/views/regisloginter.blade.php -->
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Login</title>
</head>
<body class="bg-gray-100">
<div class="container mx-auto mt-10">
<div class="max-w-md mx-auto bg-white p-5 rounded shadow">
<h2 class="text-2xl mb-4">Login</h2>
<form action="/login" method="POST">
@csrf
<div class="mb-4">
<label for="username" class="block text-sm font-medium text-gray-700">Username</label>
<input type="text" name="username" id="username" class="mt-1 block w-full border-gray-300 rounded-md shadow-sm" required>
</div>
<div class="mb-4">
<label for="password" class="block text-sm font-medium text-gray-700">Password</label>
<input type="password" name="password" id="password" class="mt-1 block w-full border-gray-300 rounded-md shadow-sm" required>
</div>
<div class="mb-4">
<button type="submit" class="bg-blue-500 text-white px-4 py-2 rounded">Login</button>
</div>
</form>
</div>
</div>
</body>
</html>
Laravel includes CSRF protection by default. The @csrf directive generates a hidden input field with a CSRF token equivalent to this:
<input type="hidden" name="_token" value="{{ csrf_token() }}">
This token helps protect your application against Cross-Site Request Forgery (CSRF) attacks, which trick users into performing unauthorized actions. The server validates this token to ensure that form submissions come from trusted sources.
These views are simple forms that allow users to register and login. The forms submit data to the /register and /login routes respectively. With these views, users can register and login to the application.
