Authentication answers who the user is. Laravel Breeze provides a minimal, official starter kit with Blade or Inertia stacks so you avoid rolling crypto and session handling from scratch.
Installing Laravel Breeze
Install Breeze as a dev dependency, run the installer artisan command, choose your stack, and migrate the database for session tables.
Breeze intentionally stays simple compared to Jetstream, which adds teams and two-factor authentication.
Step 1: Require and install Breeze
Run composer require laravel/breeze –dev then php artisan breeze:install blade or vue/react inertia variants. npm install && npm run build compiles assets.
The installer publishes routes, controllers, and views under auth namespaces. Review generated files before customizing branding.
composer require laravel/breeze --dev
php artisan breeze:install bladeStep 2: Migrate and test auth routes
php artisan migrate creates users and password reset tables. Visit /register and /login to verify forms, validation, and redirects to /dashboard.
Feature tests in tests/Feature/Auth cover registration and password reset flows. Run php artisan test –filter=Auth to confirm everything passes.
php artisan migrate
php artisan test --filter=AuthStep 3: Session guard configuration
config/auth.php defines web guard using session driver and users provider pointing to AppModelsUser. SESSION_DRIVER in .env controls file, database, or redis sessions.
Use database or redis sessions in multi-server deployments so users stay logged in regardless of which app server handles the next request.
SESSION_DRIVER=databaseStep 4: Customize auth views
Edit resources/views/auth/login.blade.php and layouts/guest.blade.php for branding. Keep @csrf tokens and error partials intact when restyling.
Extract shared input components to reduce duplication between login and register forms.
@extends('layouts.guest')Login Flow and Password Security
Breeze hashes passwords with bcrypt by default via the User model casts. Never store plaintext passwords or reversible encryption.
Rate limiting on login routes slows brute-force attacks. Laravel's throttle middleware integrates with Breeze routes.
Step 1: Registration and validation
RegisteredUserController validates name, unique email, and confirmed password before Hash::make stores the credential. Extend rules for terms acceptance or invite codes.
Dispatch Registered event to send welcome emails or provision tenant workspaces asynchronously via listeners.
'password' => ['required', 'confirmed', RulesPassword::defaults()],Step 2: Password reset tokens
Forgot password forms email signed reset links backed by password_reset_tokens table. ResetPasswordController validates token and email before updating hash.
Customize notifications by overriding sendPasswordResetNotification on the User model to use your mail template and queue.
Password::sendResetLink($request->only('email'));Step 3: Email verification
MustVerifyEmail interface on User triggers verification emails on registration. Protect routes with verified middleware so unverified users cannot access dashboards.
Resend verification from profile settings using EmailVerificationNotificationController Breeze publishes.
Route::middleware(['auth', 'verified'])->group(function () { ... });Step 4: Logout and session invalidation
AuthenticatedSessionController destroy method logs out, invalidates session, and regenerates CSRF token preventing session fixation after logout.
Call Auth::logoutOtherDevices($password) when users change passwords to revoke old sessions on other browsers.
Auth::guard('web')->logout();
$request->session()->invalidate();Profile Management and API Tokens
Breeze includes profile update and password change forms with validation. Delete account flows should confirm password and cascade related data thoughtfully.
Sanctum can issue API tokens alongside session auth when you enable Breeze's API scaffolding or add token management manually.
Step 1: Update profile information
ProfileController validates unique email ignoring the current user and supports resending verification when email changes.
Use Form Requests for profile updates to share rules between web and API profile endpoints.
$request->user()->fill($validated)->save();Step 2: Change password securely
Current password must validate before setting a new hash. Use Password::defaults() for complexity requirements aligned with security policy.
Log password changes and notify users by email when accounts may be compromised.
if (! Hash::check($request->current_password, $user->password)) { ... }Step 3: Sanctum personal access tokens
composer require laravel/sanctum and publish config. User model uses HasApiTokens trait. $user->createToken('mobile')->plainTextToken returns bearer tokens for SPAs or mobile.
Protect API routes with auth:sanctum middleware. SPA authentication uses cookie-based Sanctum config with SANCTUM_STATEFUL_DOMAINS.
$token = $user->createToken('api-client')->plainTextToken;Step 4: Social login optional extension
Laravel Socialite integrates Google or GitHub OAuth alongside Breeze. Map social IDs to users and still verify email for new accounts.
Keep OAuth secrets in .env and restrict redirect URLs in provider consoles to prevent token interception.
Socialite::driver('github')->redirect();Aadyanex implements Laravel authentication with hardened sessions, MFA options, and audited account flows for SaaS and enterprise portals.