【Laravel】Sanctumで認証API開発方法！ログイン/ログアウトとトークン管理

$ composer require laravel/sanctum

$ php artisan vendor:publish --provider="Laravel\Sanctum\SanctumServiceProvider"

$ php artisan migrate

'api' => [
    \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
    'throttle:api',
    \Illuminate\Routing\Middleware\SubstituteBindings::class,
],

class User extends Authenticatable
{
    use HasApiTokens, HasFactory, Notifiable;

    protected $fillable = [
        'name',
        'email',
        'password',
    ];

    protected $hidden = [
        'password',
        'remember_token',
    ];

    protected $casts = [
        'email_verified_at' => 'datetime',
    ];
}

$ php artisan make:controller AuthController

class AuthController extends Controller
{
    // 新規登録
    public function register(Request $request)
    {
        $validatedData = $request->validate([
            'name' => 'required|string|max:255',
            'email' => 'required|email|unique:users',
            'password' => 'required|string|min:8|confirmed',
        ]);

        $user = User::create([
            'name' => $validatedData['name'],
            'email' => $validatedData['email'],
            'password' => Hash::make($validatedData['password']),
        ]);

        return response()->json(['message' => 'User registered successfully'], 201);
    }

    // ログイン
    public function login(Request $request)
    {
        $request->validate([
            'email' => 'required|email',
            'password' => 'required',
        ]);

        $user = User::where('email', $request->email)->first();

        if (!$user || !Hash::check($request->password, $user->password)) {
            throw ValidationException::withMessages([
                'email' => ['The provided credentials are incorrect.'],
            ]);
        }

        $token = $user->createToken('auth_token')->plainTextToken;

        return response()->json([
            'access_token' => $token,
            'token_type' => 'Bearer',
        ]);
    }

    // ログアウト
    public function logout(Request $request)
    {
        $request->user()->tokens()->delete();

        return response()->json(['message' => 'Logged out successfully']);
    }

    // 認証ユーザー情報
    public function user(Request $request)
    {
        return response()->json($request->user());
    }
}

api.php
Route::post('register', [AuthController::class, 'register']);
Route::post('login', [AuthController::class, 'login']);
Route::middleware('auth:sanctum')->get('user', [AuthController::class, 'user']);
Route::middleware('auth:sanctum')->post('logout', [AuthController::class, 'logout']);

{
    "name": "テスト太郎",
    "email": "test@example.com",
    "password": "password123",
    "password_confirmation": "password123"
}

{
    "email": "test@example.com",
    "password": "password123"
}

{
    "access_token": "4|Jr8DaKo6VTSg2WhLB63wyWbRGWsf04MIPb5UMvIl",
    "token_type": "Bearer"
}

// Laravelサーバー立ち上げ
$ php artisan serve

// 新規登録
$ curl -X POST http://127.0.0.1:8000/api/register \
-H "Content-Type: application/json" \
-d '{
  "name": "testuser",
  "email": "testuser@example.com",
  "password": "password123",
  "password_confirmation": "password123"
}'
// Response
{"message":"User registered successfully"}    

// ログイン
$ curl -X POST http://127.0.0.1:8000/api/login \
-H "Content-Type: application/json" \
-d '{
  "email": "testuser@example.com",
  "password": "password123"
}'
// Response
{"access_token":"5|TNbh9DywCZRfQBCAiI6NjqCxFld8D77HPeAM68ot","token_type":"Bearer"}

// 認証ルート(ユーザー情報取得)
$ curl -X GET http://127.0.0.1:8000/api/user \
-H "Authorization: Bearer 5|TNbh9DywCZRfQBCAiI6NjqCxFld8D77HPeAM68ot" \
-H "Content-Type: application/json"
// Response
{"id":2,"name":"testuser","email":"testuser@example.com","email_verified_at":null,"created_at":"2025-01-24T14:52:30.000000Z","updated_at":"2025-01-24T14:52:30.000000Z"}

.htaccess
# Authorization ヘッダーを環境変数に保持
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [E=HTTP_AUTHORIZATION:%1]

5|TNbh9DywCZRfQBCAiI6NjqCxFld8D77HPeAM68ot

Authenticate.php
class Authenticate extends Middleware
{
    // ユーザーが認証されていない場合にリダイレクトされるパスを取得します。
    protected function redirectTo($request)
    {
        if (! $request->expectsJson()) {
            return route('login');
        }
    }
}

Handler.php
protected function unauthenticated($request, AuthenticationException $exception)
{
    return $this->shouldReturnJson($request, $exception)
                ? response()->json(['message' => $exception->getMessage()], 401)
                : redirect()->guest($exception->redirectTo() ?? route('login'));
}

App/Exception/Handler.php
// 認証失敗時のレスポンスをカスタマイズ
protected function unauthenticated($request, AuthenticationException $exception)
{
    return response()->json([
        'message' => '認証に失敗しました。トークンが無効または期限切れです。',
    ], 401);
}

'stateful' => explode(',', env('SANCTUM_STATEFUL_DOMAINS', sprintf(
    '%s%s',
    'localhost,localhost:3000,127.0.0.1,127.0.0.1:8000,::1',
    env('APP_URL') ? ','.parse_url(env('APP_URL'), PHP_URL_HOST) : ''
))),

'expiration' => null,

'middleware' => [
    'verify_csrf_token' => App\Http\Middleware\VerifyCsrfToken::class,
    'encrypt_cookies' => App\Http\Middleware\EncryptCookies::class,
],

'guard' => ['web'],

'defaults' => [
    'guard' => 'sanctum',
    'passwords' => 'users',
],

'guards' => [
    'web' => [
        'driver' => 'session',
        'provider' => 'users',
    ],
    'sanctum' => [
        'driver' => 'sanctum',
        'provider' => 'users', // 対象となるユーザー情報
    ],
],

'providers' => [
    'users' => [
        'driver' => 'eloquent',
        'model' => App\Models\User::class,
    ],
],

'passwords' => [
    'users' => [
        'provider' => 'users',
        'table' => 'password_resets',
        'expire' => 60,
        'throttle' => 60,
    ],
],