Authentication introduction

Learn the basics of Laravel’s authentication features—from setting up an authentication system with a starter kit to retrieving the authenticated user.

What is authentication

Authentication is the mechanism for confirming “who” the user accessing your application is. In web applications, you receive an email and password via a login form, and if they are correct, save the user’s information in the session. On subsequent requests, that session is used to identify the user.

Laravel’s authentication features are built around two concepts: “guards” and “providers.”

• Guards define how the user is authenticated on each request. The default is the session guard, which uses sessions and cookies to manage state.
• Providers define how users are retrieved from your database. The default uses Eloquent.

The authentication configuration file is config/auth.php. The default configuration works for most web applications as-is.

Authentication with starter kits

In Laravel, by choosing a starter kit when creating your application with laravel new, authentication features like login, registration, and password reset are automatically built for you. This is the most recommended approach.

1. Create the application

   Create your application with the Laravel installer. It will prompt you to choose a starter kit during setup.

   laravel new my-app
   

   You can select React, Vue, Livewire, or Svelte as your starter kit. Choose one that matches your team’s technology stack.

2. Install frontend dependencies

   cd my-app
   npm install && npm run build
   
3. Prepare the database

   Verify the database configuration in your .env file, then run migrations.

   php artisan migrate
   

   The initial migrations, including the users table, are applied.

4. Start the development server

   composer run dev
   

   Visit http://localhost:8000 in your browser, and you’ll see “Register” and “Log in” links in the navigation. Visit /register and try registering a user.

Once you have the starter kit, the following features are available right away.

Feature	URL
User registration	/register
Login	/login
Password reset	/forgot-password
Email verification	/email/verify
Edit profile	/settings/profile

All the code generated by the starter kit (controllers, routes, views) lives inside your own application. You can freely modify and customize it.

Available starter kits

React

Build a modern SPA using React 19, TypeScript, Tailwind, and shadcn/ui. By using Inertia, you can use a React frontend while retaining server-side routing.

Vue

Uses Vue Composition API, TypeScript, Tailwind, and shadcn-vue. Like React, it uses Inertia to integrate with the server.

Livewire

Uses Livewire to build dynamic UIs entirely in PHP. Ideal for teams that primarily work with Blade templates or want to avoid JavaScript frameworks. Includes the Flux UI component library.

Svelte

Uses Svelte 5, TypeScript, Tailwind, and shadcn-svelte. Combines with Inertia to build a modern SPA.

The Auth facade

Using the Auth facade, you can get information about the currently authenticated user and check the authentication state.

Getting the authenticated user

use Illuminate\Support\Facades\Auth;

// Get the current user
$user = Auth::user();

// Get only the user ID
$id = Auth::id();

In a controller, you can also get the user from the Request object.

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;

class DashboardController extends Controller
{
    public function index(Request $request)
    {
        $user = $request->user();

        return view('dashboard', ['user' => $user]);
    }
}

Checking authentication state

Auth::check() returns true or false depending on whether the user is logged in.

use Illuminate\Support\Facades\Auth;

if (Auth::check()) {
    // Logged in
} else {
    // Not logged in
}

In Blade templates, the @auth and @guest directives are convenient.

@auth
    <p>Hello, {{ Auth::user()->name }}</p>
    <a href="/logout">Log out</a>
@endauth

@guest
    <a href="/login">Log in</a>
    <a href="/register">Register</a>
@endguest

Protecting routes

To create routes that only authenticated users can access, use the auth middleware.

// routes/web.php

// Accessible only to authenticated users
Route::get('/dashboard', function () {
    return view('dashboard');
})->middleware('auth');

An unauthenticated user attempting access is automatically redirected to /login.

To protect multiple routes at once, use groups.

Route::middleware('auth')->group(function () {
    Route::get('/dashboard', [DashboardController::class, 'index']);
    Route::get('/profile', [ProfileController::class, 'show']);
    Route::get('/settings', [SettingsController::class, 'index']);
});

Forgetting to add the auth middleware allows unauthenticated users to access your routes. Always apply it to routes that require protection.

Guest-only routes

Use the guest middleware to redirect users who are already logged in. Applying it to login and registration pages redirects already-logged-in users to the dashboard.

Route::middleware('guest')->group(function () {
    Route::get('/login', [AuthController::class, 'showLogin']);
    Route::get('/register', [AuthController::class, 'showRegister']);
});

Manual authentication

To implement login manually without using a starter kit, use Auth::attempt().

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use Illuminate\Http\RedirectResponse;
use Illuminate\Support\Facades\Auth;

class LoginController extends Controller
{
    public function login(Request $request): RedirectResponse
    {
        $credentials = $request->validate([
            'email' => ['required', 'email'],
            'password' => ['required'],
        ]);

        if (Auth::attempt($credentials)) {
            // Authentication succeeded — regenerate the session to prevent CSRF attacks
            $request->session()->regenerate();

            return redirect()->intended('/dashboard');
        }

        // Authentication failed
        return back()->withErrors([
            'email' => 'Email or password is incorrect.',
        ])->onlyInput('email');
    }
}

Pass an array of credentials as the first argument to Auth::attempt(). The password is automatically compared against the hash, so pass it in plaintext.

To implement “remember me” functionality, pass true as the second argument.

// Use the value of the "remember me" checkbox
Auth::attempt($credentials, $request->boolean('remember'));

Even when implementing manual authentication, we recommend referring to the starter kit’s code. It’s a great reference for a secure implementation.

Logout

To log a user out, call Auth::logout(). It’s a best practice to also invalidate the session and regenerate the CSRF token.

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use Illuminate\Http\RedirectResponse;
use Illuminate\Support\Facades\Auth;

class LogoutController extends Controller
{
    public function logout(Request $request): RedirectResponse
    {
        Auth::logout();

        // Invalidate the session
        $request->session()->invalidate();

        // Regenerate the CSRF token
        $request->session()->regenerateToken();

        return redirect('/');
    }
}

Use POST for the route.

Route::post('/logout', [LogoutController::class, 'logout'])->middleware('auth');

In Blade templates, use a form to send a POST request.

<form method="POST" action="/logout">
    @csrf
    <button type="submit">Log out</button>
</form>

Summary

What you want to do	How
Add authentication quickly	Starter kit (laravel new)
Get the current user	Auth::user() / $request->user()
Check login state	Auth::check()
Protect a route	->middleware('auth')
Log in manually	Auth::attempt($credentials)
Log out	Auth::logout()

Next steps

Middleware

Learn about how the auth middleware works and how to build your own middleware.