Updated : 19th November 2014

With the recent release of Laravel 4, PHP developers have at their disposal one of the finest frameworks for application development. As with all new frameworks, it is always good to write some quick code to get a feel for the underlying architecture. The following post shows a simple authentication application using Laravel.

Installing Laravel 4

Laravel 4 uses Composer for dependency management as the framework itself depends on a number of external packages to function correctly. Each of the components used by Laravel 4 is available individually on the Illuminate GitHub repository. Laravel 4 ties together the Illuminate components to create the framework. Some of the other packages Laravel 4 uses are – Doctrine, Monolog, Symfony, Predis.

If you are new to Composer you can read all about it here. Windows users have a nice installable package available.

Our application will only have a login form and a simple admin page that requires authentication. Initially we will code the entire controller login in the route itself.

Database and User table

First you need to create a database for your Laravel application and update the app/config/database.php file with the database credentials.

'default' => 'mysql',

'mysql' => array(
			'driver'    => 'mysql',
			'host'      => 'localhost',
			'database'  => 'your_database_name',
			'username'  => 'your_database_username',
			'password'  => 'your_database_password',
			'charset'   => 'utf8',
			'collation' => 'utf8_unicode_ci',
			'prefix'    => '',
		),

Next insert the following ‘user’ table in your new database. The SQL also includes a sample row with a username an password.

CREATE TABLE IF NOT EXISTS `users` (
  `id` int(10) unsigned NOT NULL auto_increment,
  `username` varchar(128) collate utf8_unicode_ci NOT NULL,
  `password` varchar(64) collate utf8_unicode_ci NOT NULL,
  `remember_token` varchar(100) collate utf8_unicode_ci default NULL,
  PRIMARY KEY  (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=1 DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;

/*!40000 ALTER TABLE `users` DISABLE KEYS */;
INSERT INTO `users` (`id`, `username`, `password`, `remember_token`) VALUES
  (1, 'admin', '$2y$10$3T5VWug6d3KdLh1.l8J2x.8WMAjZ3tPxACvpUb7XToWQoFgjjEGWi', '');

Next we need to configure the app/config/auth.php settings. This contains some standard authentication options for your application. Note that the user authentication table is called ‘users’, same as the table name above, but you can change that to anything you like as long you also change the corresponding table name in the database. Also we will be using the ‘database’ driver instead of ‘eloquent’.

 'database',

	/*
	|--------------------------------------------------------------------------
	| Authentication Model
	|--------------------------------------------------------------------------
	|
	| When using the "Eloquent" authentication driver, we need to know which
	| Eloquent model should be used to retrieve your users. Of course, it
	| is often just the "User" model but you may use whatever you like.
	|
	*/

	'model' => 'User',

	/*
	|--------------------------------------------------------------------------
	| Authentication Table
	|--------------------------------------------------------------------------
	|
	| When using the "Database" authentication driver, we need to know which
	| table should be used to retrieve your users. We have chosen a basic
	| default value but you may easily change it to any table you like.
	|
	*/

	'table' => 'users',

	/*
	|--------------------------------------------------------------------------
	| Password Reminder Settings
	|--------------------------------------------------------------------------
	|
	| Here you may set the settings for password reminders, including a view
	| that should be used as your password reminder e-mail. You will also
	| be able to set the name of the table that holds the reset tokens.
	|
	*/

	'reminder' => array(

		'email' => 'emails.auth.reminder', 'table' => 'password_reminders',

	),

);

The Login form

First we will design a simple login form view to be displayed for the login action.
Laravel comes with the blade templating engine, but for this post we will go with the standard HTML markup. If our domain is mysite.com, the below login form will be visible at mysite.com/login. Upload the loginForm.php file to the app/views directory.

The username and password for the login form is ‘admin’.

 '/login', 'class' => 'box login')); ?>

  Username
  
  
  Forget your password?Password
  
  

We import the stylesheets using the HTML helper class. The css files are stored in the public/css directory. Next we open the form using the Form::open method. The Form::open method can take additional parameters. Here we are specifying that the form should be posted to the /login url and also that the css ‘box’ and ‘login’ classes be applied to the form.

Form::open(array('url' => '/login', 'class' => 'box login'));

The route for the above login view is given below. This will display the login form when a GET request is made to the mysite.com/login url.

#app/routes.php

Route::get('login', function()
{
    return View::make('loginForm');
});

The admin page

Our applications admin view is a simple HTML page that displays a message along with a logout link. The admin page is visible at mysite.com/admin. At this point we can access the admin page without authentication. Later we will add the code to make sure that only authenticated users can view this page.

Hello Admin!
Logout

The route for the above admin view is given below.

#app/routes.php

Route::get('admin', function()
{
    return View::make('adminPage');
});

User Authentication

Next we will define the authentication logic in the route itself rather than a separate controller. Although for smaller applications this will work fine, for larger ones it is advisable to define a separate controller. As our login form will be submitted using the POST method, we need to define our authentication logic in a POST route. Note that the logic in routes are defined using anonymous functions.

#app/routes.php

Route::post('login', function()
{
        /* Get the login form data using the 'Input' class */
        $userdata = array(
            'username' => Input::get('username'),
            'password' => Input::get('password')
        );
        
        /* Try to authenticate the credentials */
        if(Auth::attempt($userdata)) 
        {
            // we are now logged in, go to admin
            return Redirect::to('admin');
        }
        else
        {
            return Redirect::to('login');
        }
});

At this point whenever the user is correctly authenticated they are redirected to the ‘admin’ page. However at present we can also view the ‘admin’ page without any authentication.

Remembering Users

Laravel offers a easy facility to remember logged in users. If you would like to provide “remember me” functionality in your application, you may pass true as the second argument to the attempt method, which will keep the user authenticated indefinitely (or until they manually logout).

if(Auth::attempt($userdata, true))
{ ..

For that we need to see if the ‘Remember Me’ checkbox is selected during login. As our checkbox is named ‘persist’ the code for the same is given below.

if(Input::get('persist') == 'on')
   $isAuth = Auth::attempt($userdata, true);
else
   $isAuth = Auth::attempt($userdata);

Note: Make sure that ‘expire_on_close’ is set to true in ‘config/session.php’.

'expire_on_close' => true,

To test the ‘Remember Me’ feature, close and reopen the browser and open the login page. You should see the admin page with the ‘”Logged in via Remember Me” string.

Completing the app

Lastly we will define a route for the home page that will just display a simple text message.

#app/routes.php
Route::get('/', function()
{
    return "Welcome Home";
});

Restricting ‘admin’ page access

We can easily restrict ‘admin’ page access in our routes using filters. Route filters provide a convenient way of limiting access to a given route, which is useful for creating pages of your site which require authentication. There are several filters included in the Laravel framework, an auth filter, auth.basic filter, a guest filter, and a csrf filter. These are located in the app/filters.php file. We can also define our very own custom filters. In our example we will use the in-built ‘auth’ filter. This instrcuts the route to apply the auth filter before displaying the
‘admin’ page.

Route::get('admin', array('before' => 'auth', function()
{
    return View::make('adminPage');
}));

You can find the ‘auth’ filter defined in app/filters.php.

Route::filter('auth', function()
{
     if (Auth::guest()) return Redirect::guest('login');
});

Laravel filters provide a powerful and flexible way to process requests and will help you immensely while developing complex request scenarios.

To complete the application here is the logout route.

Route::get('logout', function()
{
    Auth::logout();
    return Redirect::to('login');
});

The complete routes.php is shown below.

 'auth', function()
{
    return View::make('adminPage');
}));


/* Show the 'Login' page */
Route::get('login', function()
{
    /* Run a authentication check to see if we are already logged in */
    if (Auth::check())
    {
        /* Is this login via a 'Remember Me' method */
        if (Auth::viaRemember())
        {
            /* If yes ,pass a variable to the 'admin' page */
            return Redirect::to('admin')->with('rememberMe', 1);
        }
        else
        {
            return Redirect::to('admin');
        }
    }
    else
    {
        return View::make('loginForm');
    }
    
});
 
/* Logout the user, and redirect to the 'Login' screen */
Route::get('logout', function()
{
    Auth::logout();
    return Redirect::to('login');
});

 
/* Process the login request */ 
Route::post('login', function()
{
    
    $userdata = array(
            'username' => Input::get('username'),
            'password' => Input::get('password')
        );
 
    /* Check if 'Remember Me' is checked */
    if(Input::get('persist') == 'on')
        $isAuth = Auth::attempt($userdata, true);
    else
        $isAuth = Auth::attempt($userdata);
    
    if($isAuth)
    {
        // we are now logged in, go to admin
        return Redirect::to('admin');
    }
    else
    {
        return Redirect::to('login');
    }
});

In the routes.php file define the ‘login’ route as below. The second parameter, ‘UserLogin@user’, consists of the controller name followed by the method we want to run.

Route::post('login', 'UserLogin@user');

As you can see it is very easy to use a controller within a route. This post has only scratched the surface with what Laravel has to offer. In coming posts we will look into various features mentioned here in detail. I’ve included the css files required for the login form below. Copy them to your Laravel /public/css folder.