Оффлайн
- Регистрация
- 9 Май 2015
- Сообщения
- 1,483
- Баллы
- 155
Panduan ini sangat lengkap, detail, dan proper untuk membuat backend authentication (login, register, logout, dan proteksi API) pada Laravel 9 menggunakan Sanctum serta database MySQL. Tutorial ini cocok untuk pemula maupun menengah.
Daftar Isi
- Composer:
- PHP: minimal versi 8.0
- MySQL: pastikan sudah terinstall & running
- Postman atau API Client lain (untuk testing)
- Terminal/Command Prompt
Jalankan perintah berikut di terminal:
composer create-project laravel/laravel:^9.0 laravel-sanctum-auth
cd laravel-sanctum-auth
3. Konfigurasi Database MySQL
Edit file .env dan sesuaikan konfigurasi berikut:
DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=nama_database
DB_USERNAME=root
DB_PASSWORD=passwordmysql
Buat database di MySQL sesuai nama pada DB_DATABASE (misal: laravel_sanctum).
4. Install Laravel Sanctum
Jalankan perintah berikut:
composer require laravel/sanctum
5. Publish dan Migrasi Sanctum
Publish config Sanctum:
php artisan vendor:publish --provider="Laravel\Sanctum\SanctumServiceProvider"
Lalu migrate:
php artisan migrate
6. Konfigurasi Auth Sanctum
a. Tambahkan middleware Sanctum di app/Http/Kernel.php pada group api:
// app/Http/Kernel.php
protected $middlewareGroups = [
// ...
'api' => [
\Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
'throttle:api',
\Illuminate\Routing\Middleware\SubstituteBindings::class,
],
];
b. Set driver API di .env:
SANCTUM_STATEFUL_DOMAINS=localhost
SESSION_DRIVER=cookie
7. Buat Endpoint Authentication (Register, Login, Logout, Me)
a. Buat Controller
php artisan make:controller AuthController
b. Implementasi Controller
// app/Http/Controllers/AuthController.php
<?php
namespace App\Http\Controllers;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use App\Models\User;
use Illuminate\Support\Facades\Hash;
class AuthController extends Controller
{
// REGISTER
public function register(Request $request)
{
$request->validate([
'name' => 'required|string|max:255',
'email' => 'required|string|email|unique:users',
'password' => 'required|string|min:6',
]);
$user = User::create([
'name' => $request->name,
'email' => $request->email,
'password' => Hash::make($request->password),
]);
return response()->json([
'message' => 'User registered successfully!',
'user' => $user
], 201);
}
// LOGIN
public function login(Request $request)
{
$request->validate([
'email' => 'required|email',
'password' => 'required',
]);
$user = User::where('email', $request->email)->first();
if (! $user || ! Hash::check($request->password, $user->password)) {
return response()->json(['message' => 'Invalid credentials'], 401);
}
$token = $user->createToken('auth_token')->plainTextToken;
return response()->json([
'message' => 'Login success!',
'access_token'=> $token,
'token_type' => 'Bearer',
'user' => $user,
]);
}
// LOGOUT
public function logout(Request $request)
{
$request->user()->currentAccessToken()->delete();
return response()->json([
'message' => 'Logged out successfully'
]);
}
// ME - Get current user
public function me(Request $request)
{
return response()->json($request->user());
}
}
c. Tambahkan Route API
// routes/api.php
use App\Http\Controllers\AuthController;
Route::post('/register', [AuthController::class, 'register']);
Route::post('/login', [AuthController::class, 'login']);
Route::middleware('auth:sanctum')->group(function () {
Route::post('/logout', [AuthController::class, 'logout']);
Route::get('/me', [AuthController::class, 'me']);
});
8. Proteksi Route API dengan Sanctum
Contoh menambah route yang hanya bisa diakses oleh user yang sudah login:
Route::middleware('auth:sanctum')->get('/profile', function (Request $request) {
return response()->json($request->user());
});
Bisa juga untuk route resource lain:
Route::middleware('auth:sanctum')->group(function() {
Route::get('/posts', [PostController::class, 'index']);
// dan lain-lain...
});
9. Test API dengan Postman
a. Register
- POST
Body (JSON):
{
"name": "Roni",
"email": "roni@example.com",
"password": "password123"
}
- POST
Body (JSON):
{
"email": "roni@example.com",
"password": "password123"
}
Response: Dapatkan access_token.
- GET
Header:
Authorization: Bearer <access_token>
Response: Data user yang sedang login.
- POST
Header:
Authorization: Bearer <access_token>
- Gunakan HTTPS di server production.
- Validasi semua input user.
- Untuk multi device login, jangan lupa revoke token jika diperlukan:
$request->user()->tokens()->delete(); // logout all device
- Untuk mobile app, gunakan storage secure untuk token.
Sekarang backend Laravel 9 Anda sudah mendukung autentikasi API yang aman menggunakan Sanctum dan MySQL.
Anda bisa menambah fitur, seperti verifikasi email, reset password, atau role management sesuai kebutuhan.
Selamat mencoba!
Referensi: