Laravelでセッション認証とAPI（JWT）認証を併用する

1
<?php
2

3
namespace App\Models;
4

5
use Illuminate\Database\Eloquent\Factories\HasFactory;
6
use Illuminate\Foundation\Auth\User as Authenticatable;
7
use Illuminate\Notifications\Notifiable;
8
use Tymon\JWTAuth\Contracts\JWTSubject;
9

10
class User extends Authenticatable implements JWTSubject
11
{
12
  use HasFactory, Notifiable;
13

14
  // ...
15

16
  /**
17
   * Get the identifier that will be stored in the subject claim of the JWT.
18
   *
19
   * @return mixed
20
   */
21
  public function getJWTIdentifier()
22
  {
23
    return $this->getKey();
24
  }
25

26
  /**
27
   * Return a key value array, containing any custom claims to be added to the JWT.
28
   *
29
   * @return array
30
   */
31
  public function getJWTCustomClaims()
32
  {
33
    return [];
34
  }
35
}

1
'guards' => [
2
  'web' => [
3
    'driver' => 'session',
4
    'provider' => 'users',
5
  ],
6
  'api' => [
7
    'driver' => 'jwt',
8
    'provider' => 'users',
9
  ],
10
],

1
<?php
2

3
use Illuminate\Support\Facades\Route;
4
use App\Http\Controllers\Api\AuthController;
5

6
Route::prefix('auth')->group(function () {
7
    Route::post('login', [AuthController::class, 'login']);
8

9
    Route::middleware('api')->group(function () {
10
        Route::post('logout', [AuthController::class, 'logout']);
11
        Route::post('refresh', [AuthController::class, 'refresh']);
12
        Route::post('me', [AuthController::class, 'me']);
13
    });
14
});

1
<?php
2

3
namespace App\Http\Controllers\Api;
4

5
use App\Http\Controllers\Controller;
6

7
class AuthController extends Controller
8
{
9
  /**
10
  * Get a JWT via given credentials.
11
  *
12
  * @return \Illuminate\Http\JsonResponse
13
  */
14
  public function login()
15
  {
16
    $credentials = request(['email', 'password']);
17

18
    if (! $token = auth('api')->attempt($credentials)) {
19
      return response()->json(['error' => 'Unauthorized'], 401);
20
    }
21
    return $this->respondWithToken($token);
22
  }
23

24
  /**
25
  * Get the authenticated User.
26
  *
27
  * @return \Illuminate\Http\JsonResponse
28
  */
29
  public function me()
30
  {
31
    return response()->json(auth('api')->user());
32
  }
33

34
  /**
35
  * Log the user out (Invalidate the token).
36
  *
37
  * @return \Illuminate\Http\JsonResponse
38
  */
39
  public function logout()
40
  {
41
    auth('api')->logout();
42

43
    return response()->json(['message' => 'Successfully logged out']);
44
  }
45

46
  /**
47
  * Refresh a token.
48
  *
49
  * @return \Illuminate\Http\JsonResponse
50
  */
51
  public function refresh()
52
  {
53
    return $this->respondWithToken(auth('api')->refresh());
54
  }
55

56
  /**
57
  * Get the token array structure.
58
  *
59
  * @param  string $token
60
  *
61
  * @return \Illuminate\Http\JsonResponse
62
  */
63
  protected function respondWithToken($token)
64
  {
65
    return response()->json([
66
      'access_token' => $token,
67
      'token_type' => 'bearer',
68
      'expires_in' => auth('api')->factory()->getTTL() * 60
69
    ]);
70
  }
71
}