Cookie Guard is a Laravel API authentication package using cookie tokens. Most of its inner workings are taken from Laravel Passport package. It is meant to be used to consume your own API with JavaScript.

Require this package, with Composer, in the root directory of your project.

$ composer require lukapeharda/cookie-guard

Add the service provider to config/app.php in the providers array.

LukaPeharda\CookieGuard\CookieGuardServiceProvider::class,

Add the LukaPeharda\CookieGuard\HasApiTokens trait to your App\User model. This trait will provide a few helper methods to your model which allow you to inspect the authenticated user's token and scopes:

<?php

namespace App;

use LukaPeharda\CookieGuard\HasApiTokens;
use Illuminate\Notifications\Notifiable;
use Illuminate\Foundation\Auth\User as Authenticatable;

class User extends Authenticatable
{
    use HasApiTokens, Notifiable;
}

Add the CreateFreshApiToken middleware to your web middleware group:

'web' => [
    // Other middleware...
    \LukaPeharda\CookieGuard\Http\Middleware\CreateFreshApiToken::class,
],

This middleware will attach a laravel_token cookie to your outgoing responses.

Finally, in your config/auth.php configuration file, you should set the driver option of the api authentication guard to cookie. This will instruct your application to use CookieGuards's CookieGuard when authenticating incoming API requests:

'guards' => [
    'web' => [
        'driver' => 'session',
        'provider' => 'users',
    ],
    'api' => [
        'driver' => 'cookie',
        'provider' => 'users',
    ],
],

This middleware will attach a laravel_token cookie to your outgoing responses. This cookie contains an encrypted JWT that CookieGuard will use to authenticate API requests from your JavaScript application.

When using this method of authentication, you will need to send the CSRF token with every request via the X-CSRF-TOKEN header. Laravel will automatically send this header if you are using the default Vue configuration that is included with the framework:

Vue.http.interceptors.push((request, next) => {
    request.headers['X-CSRF-TOKEN'] = Laravel.csrfToken;
    next();
});

Cookie Guard is open-sourced software licensed under the MIT license