16. Authentication & API Security: Laravel Sanctum, Passport (OAuth2) & Policy Gates (RBAC) • PHP 8+ & Laravel 11/12: Enterprise Full-Stack AI Developer • Rishabh Ki Kaksha

PHP 8+ & Laravel 11/12: Enterprise Full-Stack AI Developer › 16. Authentication & API Security: Laravel Sanctum, Passport (OAuth2) & Policy Gates (RBAC)

50 mins

← Prev Next →

Course Syllabus

Module 1: Modern PHP 8.2/8.3 Internals, Type System & CLI

01. PHP 8.2/8.3 Evolution: JIT Compiler, Zend VM Internals & Strict Typing System 02. Control Flow, Pattern Matching with match(), First-Class Callables & Fiber Concurrency 03. Modern OOP PHP: Constructor Promotion, Readonly Classes, Traits, Enums & Attributes

Module 2: Dependency Management, Autoloading & Database Engineering

04. Composer Mastery: PSR-4 Autoloading, Custom Packages & Composer Scripts 05. PDO Database Layer: Prepared Statements, SQL Injection Defense & Transaction Savepoints 06. Memory Profiling, Garbage Collection (Zend GC) & OPcache Performance Tuning

Module 3: Laravel 11/12 Core Architecture & Service Container

07. Laravel 11/12 Architecture: Request Lifecycle, bootstrap/app.php & Service Providers 08. The Inversion of Control (IoC) Service Container & Automatic Dependency Injection 09. Middleware Pipeline, Custom Global Pipeline Handlers & Terminating Middleware 10. Advanced Routing, Route Model Binding & Rate Limiting (Throttle Middleware)

Module 4: Eloquent ORM Masterclass & High-Scale Database Systems

11. Eloquent ORM Internals: Active Record vs Data Mapper, Eager vs Lazy Loading (N+1 Problem) 12. Advanced Relationships: Polymorphic, Many-to-Many with Pivots & HasManyThrough 13. Query Scopes, Custom Eloquent Casts, Mutators/Accessors & Raw Query Optimizations

Module 5: High-Performance Queues, WebSockets & Security Architecture

14. Laravel Queues & Background Jobs: Redis Drivers, Horizon, Retries & Dead Letter Queues 15. Real-Time Event Broadcasting with Laravel Reverb, WebSockets & Echo 16. Authentication & API Security: Laravel Sanctum, Passport (OAuth2) & Policy Gates (RBAC) 17. Security Hardening: CSRF, XSS, Mass Assignment Protection & Encrypted Cookies

Module 6: Enterprise Full-Stack AI, Testing & Cloud Deployment

18. Testing Masterclass: Pest PHP, PHPUnit, Database Transactions & Mocking HTTP Calls 19. Enterprise Generative AI Integration: LLM Tool Calling, Vector Search & OpenAI/Claude APIs 20. Production Deployment: Laravel Octane (FrankenPHP/Swoole), PM2/Supervisor & Docker Deployments

Interactive Lesson Studio

# 16. Authentication & API Security: Laravel Sanctum, Passport (OAuth2) & Policy Gates (RBAC)

> PHP 8+ & Laravel 11/12 Notes by Rishabh - Topic 16

---

### 1. Sanctum vs Passport (The Right Tool for the Job 🔑)

*   **Laravel Sanctum (SPA & Mobile Tokens 👑):** Lightweight stateful cookie auth for SPAs (Next.js/React) + simple bearer tokens for mobile apps (`$user->createToken('mobile')->plainTextToken`).
*   **Laravel Passport (Full OAuth2 Server):** Full OAuth2 specification (Authorization Code Grant, Client Credentials, JWT Tokens) for enterprise third-party API consumers.

---

### 2. Role-Based Access Control (RBAC) with Policy Gates

```php
// app/Policies/LessonPolicy.php
class LessonPolicy {
    public function update(User $user, Lesson $lesson): bool {
        return $user->hasRole('instructor') && $user->id === $lesson->course->instructor_id;
    }
}

// Controller usage:
$this->authorize('update', $lesson);
```

---

### 3. Interview Ke 3 Sawal Is Topic Se

1. **SPA Authentication in Sanctum CSRF protection kaise enforce karti hai?** -> `/sanctum/csrf-cookie` endpoint se `XSRF-TOKEN` cookie initialize karke har subsequent AJAX request ke header me verify karna.
2. **Token Abilities (Scopes) in Sanctum kaise assign hoti hain?** -> `$user->createToken('api', ['lessons:read', 'orders:create'])` and verify via `$user->tokenCan('lessons:read')`.
3. **Super Admin Gate Before filter kaise likha jata hai?** -> `Gate::before(fn($user) => $user->isSuperAdmin() ? true : null)` taaki root admins ke liye saare gates automatically bypass hon.

---
**Next Topic:** 17. Security Hardening: CSRF, XSS, Mass Assignment Protection & Encrypted Cookies

Loading lesson content...

PHP 8.3

Full IDE

Live Execution Terminal

Click "Execute Live" to run code.
                

Lesson Mastery AI Quiz

AI Doubt Solver

CERTIFICATE OF COMPLETION

Rishabh Gehlot

PHP 8+ & Laravel 11 Master Track