Why's Auth::check() returning false even though I'm logging in successfully?

Question

I'm using Passport for my authentication system.

I'm not sure why Auth::check()'s returning false even though I'm using the correct credentials to login. I can verify that the login works because if I type in a wrong email and password, the login fails.

I've been stuck on this for a few days and not sure what's wrong.

public function login(Request $request) {

    $user = User::where('email', $request->email)->firstOrFail();

    if (Hash::check($request->password, $user->password)) {
        $loginToken = $user->createToken('MyApp')->accessToken;
        dd(Auth::check());
        return response()->json([
            'message' => 'Successfully logged in',
            'loginToken' => $loginToken
        ]);
    }

    return $this->sendError('Unauthorized.', ['error' => 'Unauthorized']);
}

Here's api.php:

Route::group(['middleware' => 'api'], function(){
   Route::post('/login', [RegisterController::class, 'login']);
});

Here's auth.php:

'defaults' => [
    'guard' => 'api',
    'passwords' => 'users',
],

'guards' => [
    'web' => [
        'driver' => 'session',
        'provider' => 'users',
    ],

    'api' => [
        'driver' => 'passport',
        'provider' => 'users',
    ],
],

Here's login:

const handleSubmitLogin = (e) => {
    e.preventDefault();
    let dataLogin = {
        'email': email,
        'password': password,
    };

    JSON.stringify(dataLogin);

    axios.post('http://site.test/api/login', dataLogin)
        .then(resp => {
            console.log(resp);
            history.push('/gallery');
        }).catch(error => {
        console.log(error);
    });

    setUserState('myState');

};

dd() response:

    Illuminate\Http\Client\Response {#329
  #response: GuzzleHttp\Psr7\Response {#365
    -reasonPhrase: "Unauthorized"
    -statusCode: 401
    -headers: array:8 [
      "Server" => array:1 [
        0 => "nginx/1.18.0 (Ubuntu)"
      ]
      "Content-Type" => array:1 [
        0 => "application/json"
      ]
      "Transfer-Encoding" => array:1 [
        0 => "chunked"
      ]
      "Connection" => array:1 [
        0 => "keep-alive"
      ]
      "Cache-Control" => array:1 [
        0 => "no-cache, private"
      ]
      "Date" => array:1 [
        0 => "Sun, 26 Sep 2021 16:06:57 GMT"
      ]
      "X-RateLimit-Limit" => array:1 [
        0 => "60"
      ]
      "X-RateLimit-Remaining" => array:1 [
        0 => "57"
      ]
    ]
    -headerNames: array:8 [
      "server" => "Server"
      "content-type" => "Content-Type"
      "transfer-encoding" => "Transfer-Encoding"
      "connection" => "Connection"
      "cache-control" => "Cache-Control"
      "date" => "Date"
      "x-ratelimit-limit" => "X-RateLimit-Limit"
      "x-ratelimit-remaining" => "X-RateLimit-Remaining"
    ]
    -protocol: "1.1"
    -stream: GuzzleHttp\Psr7\Stream {#363
      -stream: stream resource @9
        wrapper_type: "PHP"
        stream_type: "TEMP"
        mode: "w+b"
        unread_bytes: 0
        seekable: true
        uri: "php://temp"
        options: []
      }
      -size: null
      -seekable: true
      -readable: true
      -writable: true
      -uri: "php://temp"
      -customMetadata: []
    }
  }
  #decoded: null
  +"cookies": GuzzleHttp\Cookie\CookieJar {#343
    -cookies: []
    -strictMode: false
  }
  +"transferStats": GuzzleHttp\TransferStats {#364
    -request: GuzzleHttp\Psr7\Request {#359
      -method: "POST"
      -requestTarget: null
      -uri: GuzzleHttp\Psr7\Uri {#349
        -scheme: "http"
        -userInfo: ""
        -host: "site.test"
        -port: null
        -path: "/oauth/token"
        -query: ""
        -fragment: ""
      }
      -headers: array:4 [
        "Content-Length" => array:1 [
          0 => "115"
        ]
        "User-Agent" => array:1 [
          0 => "GuzzleHttp/7"
        ]
        "Host" => array:1 [
          0 => "site.test"
        ]
        "Content-Type" => array:1 [
          0 => "application/x-www-form-urlencoded"
        ]
      ]
      -headerNames: array:4 [
        "content-length" => "Content-Length"
        "user-agent" => "User-Agent"
        "host" => "Host"
        "content-type" => "Content-Type"
      ]
      -protocol: "1.1"
      -stream: GuzzleHttp\Psr7\Stream {#350
        -stream: stream resource @7
          wrapper_type: "PHP"
          stream_type: "TEMP"
          mode: "w+b"
          unread_bytes: 0
          seekable: true
          uri: "php://temp"
          options: []
        }
        -size: 115
        -seekable: true
        -readable: true
        -writable: true
        -uri: "php://temp"
        -customMetadata: []
      }
    }
    -response: GuzzleHttp\Psr7\Response {#365}
    -transferTime: 0.080212
    -handlerStats: array:38 [
      "url" => "http://site.test/oauth/token"
      "content_type" => "application/json"
      "http_code" => 401
      "header_size" => 265
      "request_size" => 260
      "filetime" => -1
      "ssl_verify_result" => 0
      "redirect_count" => 0
      "total_time" => 0.080212
      "namelookup_time" => 0.000237
      "connect_time" => 0.00033
      "pretransfer_time" => 0.000366
      "size_upload" => 115.0
      "size_download" => 118.0
      "speed_download" => 1475.0
      "speed_upload" => 1437.0
      "download_content_length" => -1.0
      "upload_content_length" => 115.0
      "starttransfer_time" => 0.078857
      "redirect_time" => 0.0
      "redirect_url" => ""
      "primary_ip" => "127.0.0.1"
      "certinfo" => []
      "primary_port" => 80
      "local_ip" => "127.0.0.1"
      "local_port" => 59814
      "http_version" => 2
      "protocol" => 1
      "ssl_verifyresult" => 0
      "scheme" => "HTTP"
      "appconnect_time_us" => 0
      "connect_time_us" => 330
      "namelookup_time_us" => 237
      "pretransfer_time_us" => 366
      "redirect_time_us" => 0
      "starttransfer_time_us" => 78857
      "total_time_us" => 80212
      "appconnect_time" => 0.0
    ]
    -handlerErrorData: 0
  }
}

Answer 1

Besides @Anthony Aslangul answer is right, I see that your login is not correct.

As per Laravel Passport Documentation

Once you have created a password grant client, you may request an access token by issuing a POST request to the /oauth/token route with the user's email address and password.

Saying that, the right way to login should be like this, withing your login function

$response = Http::asForm()->post('http://site.test/oauth/token', [
    'grant_type' => 'password',
    'client_id' => 'client-id',
    'client_secret' => 'client-secret',
    'username' => $request->email,
    'password' => $request->password,
    'scope' => '',
]);

$result = $response->getBody()->getContents();
$access_token = json_decode($result)->access_token;
$refresh_token = json_decode($result)->refresh_token;

return response()->json([
   'access_token' => $access_token,
   'refresh_token' => $refresh_token
], $response->getStatusCode());

In addition, in order to check if your user is logged in, you can try by specifying your guard such as

Auth::guard('api')->check()

These also may help you:

how to check if user is authenticated with passport (get user from token using laravel-passport)

Laravel Passport Token doesn't return series of code

Answer 2

Technically you are not logged in at this point.

You have checked that the user exists, then you have created a new token for this user, but that's all, the token has not been used to authenticate anyone.

In order to authenticate the user, you will need to make a request with the Authorization header setup: Authorization: Bearer $the_token_you_created.

The usual workflow for api tokens is:

• Make a request to the server with username and password
• The server sends back a token in the response
• You use this token for every subsequent api calls (you can store it in the local storage or a cookie)

However, you are using Passport... which don't make sense since you don't seem to need OAuth2 support. You should better take a look at Sanctum with api tokens.