Passport - "Unauthenticated." - Laravel 5.3

14
votes

I hope someone could explain why I'm unauthenticated when already has performed a successfull Oauth 2 authentication process.

I've set up the Passport package like in Laravel's documentation and I successfully get authenticated, receives a token value and so on. But, when I try to do a get request on, let say, /api/user, I get a Unauthenticated error as a response. I use the token value as a header with key name Authorization, just as described in the docs.

Route::get('/user', function (Request $request) {
    return $request->user();
})->middleware("auth:api");

This function is suppose to give back my self as the authenticated user, but I'm only getting Unauthenticated. Likewise, if I just return the first user, I'm again getting Unauthenticated.

Route::get('/test', function(Request $request) {
    return App\User::whereId(1)->first();
})->middleware("auth:api");

In a tutorial from Laracast, guiding through the setup of Passport, the guider doesn't have the ->middleware("auth:api") in his routes. But if its not there, well then there's no need for authentication at all!

Please, any suggestions or answers are more then welcome!

4
authenticationlaravel-5.3laravel-passport
Maybe you could check if you are sending "Bearer <access_token>" in Authorization Header – Urizev
Im not even getting "Unauthenticated" I get immediately redirected to the login page. – Ricki Moore
All the routes that you write inside your routes\api.php file are by default protected with the api middleware. So, you can remove your explicit mentioning of ->middleware("auth:api") . – Hari Harker
In addition with @Urizev comment, can you also check that your token is not expired and/or revoked just in case. Your route translates to yourapproute/user , so make sure you are requesting to this route instead of yourapproute/api/user . Verify this using php artisan route:list that your route is guarded by auth:api – Raymond Lagonda

4 Answers

5
votes

You have to set an expiration date for the tokens you are generating,

set the boot method in your AuthServiceProvider to something like the code below and try generating a new token. Passports default expiration returns a negative number

public function boot()
{
  $this->registerPolicies();
   Passport::routes();
   Passport::tokensExpireIn(Carbon::now()->addDays(15));
   Passport::refreshTokensExpireIn(Carbon::now()->addDays(30));
}
2
votes

Check your user model and the database table, if you have modified the primary id field name to say something other than "id" or even "user_id" you MIGHT run into issues. I debugged an issue regarding modifying the primary id field in my user model and database table to say "acct_id" instead of keeping it as just "id" and the result was "Unauthenticated" When I tried to get the user object via GET /user through the auth:api middleware. Keep in mind I had tried every other fix under the sun until I decided to debug it myself.

ALSO Be sure to UPDATE your passport. As it has had some changes made to it in recent weeks.

I'll link my reference below, it's VERY detailed and well defined as to what I did and how I got to the solution.

Enjoy!

https://github.com/laravel/passport/issues/151

1
votes

I had this error because of that I deleted passport mysql tables(php artisan migrate:fresh), php artisan passport:install helps me. Remember that after removing tables, you need to re-install passport!

1
votes

I had exactly the same error because I forgot to put http before the project name.

use Illuminate\Http\Request;

Route::get('/', function () {
    $query = http_build_query([
        'client_id' => 3,
        'redirect_uri' => 'http://consumer.dev/callback',
        'response_type' => 'code',
        'scope' => '',
    ]);

    // The redirect URL should start with http://
    return redirect('passport.dev/oauth/authorize?'.$query);
});

Route::get('/callback', function (Request $request) {
    $http = new GuzzleHttp\Client;

    $response = $http->post('http://passport.dev/oauth/token', [
        'form_params' => [
            'grant_type' => 'authorization_code',
            'client_id' => 3,
            'client_secret' => 'M8y4u77AFmHyYp4clJrYTWdkbua1ftPEUbciW8aq',
            'redirect_uri' => 'http://consumer.dev/callback',
            'code' => $request->code,
        ],
    ]);

    return json_decode((string) $response->getBody(), true);
});