Laravel 5.3 Passport路由使用Web中间件

Question

Laravel 5.3 Passport component looks pretty cool, but I have some confusion on it.

On documentation Passport is under API Authentication, and when set config/auth.php, it will change driver to be 'passport' of guards 'api'.

Laravel 5.3 have web.php and api.php to differ routes group to use web middleware or api middleware.

After installed Passport, there's a step to add Passport:routes() to AuthServiceProvider. When I run route:list it will show the new routes are all using web and auth middleware.

My question is why these passport routes using web middleware? For my understand Passport should work for stateless APIs authentication, but web middleware is not.

Answer 1

I seem to have solved this.

First thing I did was add and configure a CORS middleware from here https://github.com/barryvdh/laravel-cors

Then I wrapped the Passport routes in a route group by editing app/Providers/AuthServiceProvider.php

/** 
 * Register any authentication / authorization services.
 *
 * @return void
 */
public function boot()
{   
    $this->registerPolicies();

    Route::group(['prefix' => 'api', 'middleware' => 'cors'], function() {

        Passport::routes();

    }); 
}

In theory, if you wanted to use the oauth service outside of your API, you could have two instances of the Passport routes, one with the /api prefix and the cors middleware, then one without, so you don't lose cross-origin protection when using oauth in the browser.