John Davidson

Message:

I am making a Laravel application which will be issuing bearer token using Laravel Passport. So the idea is that a client who wants to use our system will come and register and create the Client_Secret and the Client_ID, then upon creating these oath clients credentials the client will then take these credentials and integrate them in his application. Now here is the problem, upon the client integrating the Client_ID and the Client_Secret in his application I want him to use those credentials to request the authorization code on the Laravel system and make the bearer token (using his own app), now according to Laravel documentation on Laravel passport it says that the Oath API for making the authorization code and the bearer token is guarded by the web and Auth middleware; therefore, it may only be called from your own application. It is not able to be called from an external source. Does that mean that there is no way of allowing external users to access the oath routes of passports using their external applications? or is it ok to allow them make the bearer token on the Laravel system and taking that token to integrate them in their own app?

---

My Answer:
You can allow unauthenticated users to access OAuth routes in Laravel Passport by customizing the middleware used for those routes. By default, Laravel Passport uses the `web` and `auth` middleware to protect OAuth routes, but you can create a custom middleware that allows unauthenticated access to those routes.

Here's an example of how you can create a custom middleware to allow unauthenticated access to OAuth routes:

1. Create a new middleware using the following command:
bash
php artisan make:middleware AllowUnauthenticated


2. Open the newly created middleware file (`app/Http/Middleware/AllowUnauthenticated.php`) and modify the `handle` method to allow unauthenticated access to OAuth routes:
php
public function handle($request, Closure $next)
{
// Allow unauthenticated access to OAuth routes
if ($request->is('oauth/*')) {
return $next($request);
}

return $this->authenticate($request, $next);
}


3. Register the custom middleware in your `app/Http/Kernel.php` file:
php
protected $routeMiddleware = [
// Other middleware...
'allow_unauthenticated' => \App\Http\Middleware\AllowUnauthenticated::class,
];


4. Apply the custom middleware to the OAuth routes in your `routes/api.php` file:
php
Route::group(['middleware' => 'allow_unauthenticated'], function () {
// OAuth routes
Route::post('oauth/token', '\Laravel\Passport\Http\Controllers\AccessTokenController@issueToken');
// Add other OAuth routes here...
});


By following these steps, you can allow unauthenticated users to access OAuth routes in Laravel Passport using their external applications. Just make sure to properly secure and validate the requests to prevent unauthorized access to sensitive data.