Auth in Leaf MVC

Leaf Auth comes with everything you need to authenticate users, including login, registration, account verification and more. You can add it to your Leaf MVC project using the Leaf CLI or composer:

Leaf CLIComposer

bash

leaf install auth

bash

composer require leafs/auth

Leaf Auth will automatically pick up your default database connection and will work with it, so you can immediately start working with it without any config. Checkout the following pages to authenticate users:

Configuring Auth

Although Leaf Auth works out of the box for most applications, you may have some specific requirements that you need to configure. You can configure Leaf Auth using your .env file:

.env

txt

AUTH_DB_TABLE=users
AUTH_DB_ID=id
AUTH_TIMESTAMPS=true
AUTH_TIMESTAMPS_FORMAT='YYYY-MM-DD HH:mm:ss'
AUTH_SESSIONS=true

These are options for the database table to store users, the primary key of the table, whether to use timestamps and the format of the timestamps, and whether to use sessions. If you need to configure something else, you will need to publish the entire auth config using the MVC CLI:

bash

php leaf config:publish auth

This will generate a config/auth.php file with the default auth config. You can then edit this file to suit your needs.

php

<?php

use Leaf\Helpers\Password;

return [
    /*
    |--------------------------------------------------------------------------
    | Database table
    |--------------------------------------------------------------------------
    |
    | This is the table that leaf auth will perform authentication
    | checks on and edit/retrieve users from.
    |
    */
    'db.table' => _env('AUTH_DB_TABLE', 'users'),

    /*
    |--------------------------------------------------------------------------
    | ID Key
    |--------------------------------------------------------------------------
    |
    |  Set your primary key name. For instance, you might have used id_user instead of id.
    |  This setting allows you to quickly switch your key name
    |
    */
    'id.key' => _env('AUTH_DB_ID', 'id'),

    /*
    |--------------------------------------------------------------------------
    | Generate timestamps
    |--------------------------------------------------------------------------
    |
    | Automatically generate created_at/updated_at timestamps for register
    | and update methods
    |
    */
    'timestamps' => true,

    /*
    |--------------------------------------------------------------------------
    | Set timestamps format
    |--------------------------------------------------------------------------
    |
    | Use this property to specify the format that you want your timestamps to be saved in.
    | Be aware that auth uses the leafs/date module, so the accepted formats are listed in the leafs/date documentation
    |
    */
    'timestamps.format' => 'YYYY-MM-DD HH:mm:ss',

    /*
    |--------------------------------------------------------------------------
    | Encode password
    |--------------------------------------------------------------------------
    |
    | Password encode is run when leaf wants to encode passwords on register
    | This exact method is used by default in Leaf, so you can set it to null
    | if you want to.
    |
    | You can set your own implementation instead of Password::hash
    |
    */
    'password.encode' => function ($password) {
        return Password::hash($password);
    },

    /*
    |--------------------------------------------------------------------------
    | Verify Password
    |--------------------------------------------------------------------------
    |
    | This function is run to verify the password. This implementation is done
    | by default, so you can set it to null, and it will still work fine.
    |
    | You can add your own implementation instead of Password::verify
    |
    */
    'password.verify' => function ($password, $hashedPassword) {
        return Password::verify($password, $hashedPassword);
    },

    /*
    |--------------------------------------------------------------------------
    | Password Key
    |--------------------------------------------------------------------------
    |
    | The default password key. Leaf will expect this key to hold passwords
    | in your database.
    |
    */
    'password.key' => 'password',

    /*
    |--------------------------------------------------------------------------
    | Unique fields
    |--------------------------------------------------------------------------
    |
    | This is a list of items that should be unique to each user eg: email
    |
    */
    'unique' => ['email'],

    /*
    |--------------------------------------------------------------------------
    | Hidden fields
    |--------------------------------------------------------------------------
    |
    | This is a list of items that should be hidden when
    | a user object is returned. You should use the field name
    | exactly as it is in the database.
    |
    */
    'hidden' => ['field.id', 'field.password'],

    /*
    |--------------------------------------------------------------------------
    | Use session
    |--------------------------------------------------------------------------
    |
    | Use session based authentication instead of the default JWT based auth.
    |
    */
    'session' => _env('AUTH_SESSION', true),

    /*
    |--------------------------------------------------------------------------
    | Session lifetime
    |--------------------------------------------------------------------------
    |
    | Set the lifetime of the session. After this time, the session will expire and the user will have to login again.
    | You can either use '1 day' format or as an integer: 86400
    | You can also set session.lifetime to 0 to disable session expiration.
    |
    */
    'session.lifetime' => 60 * 60 * 24,

    /*
    |--------------------------------------------------------------------------
    | SESSION COOKIE PARAMS
    |--------------------------------------------------------------------------
    |
    | Set the session cookie params
    | Read more: https://www.php.net/manual/en/function.session-set-cookie-params.php
    |
    | secure: cookie should only be sent over secure connections (https)
    | httponly: cookie should only be accessible through HTTP requests
    | samesite: cookie should be sent with "SameSite" directives :-
    |       Possible values for samesite: 'strict', 'lax', 'none' or null
    |
    |
    */
    'session.cookie' => ['secure' => false, 'httponly' => true, 'samesite' => 'lax'],

    /*
    |--------------------------------------------------------------------------
    | JWT Lifetime
    |--------------------------------------------------------------------------
    |
    | How long should JWT be valid for?
    |
    */
    'token.lifetime' => 60 * 60 * 24 * 365,

    /*
    |--------------------------------------------------------------------------
    | JWT Token Secret
    |--------------------------------------------------------------------------
    |
    | Secret string to encode JWT
    |
    */
    'token.secret' => _env('AUTH_TOKEN_SECRET', '@leaf$MVC*JWT#AUTH.Secret'),

    /*
    |--------------------------------------------------------------------------
    | Login params error
    |--------------------------------------------------------------------------
    |
    | Error to show when the login params aren't found in db
    |
    */
    'messages.loginParamsError' => 'Incorrect credentials!',

    /*
    |--------------------------------------------------------------------------
    | Password error
    |--------------------------------------------------------------------------
    |
    | Error to show when the login password is wrong
    |
    */
    'messages.loginPasswordError' => 'Password is incorrect!',
];

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192

While this is quite lengthy, it offers fine-grained control over how Leaf Auth works in your application.

What to read next

Now that you have built a simple pre-launch page, the next step is to get you familiar with the basics of building a full-stack application with Leaf. So you can build and launch your next big idea fast.

Routing
Learn more about routing in Leaf MVC, dynamic routes, middleware and more.
Handling Requests
Learn how to process incoming requests, handle form submissions, and more.
Using Databases
Learn how to build queries, build relationships, and interact with your database programmatically.
Frontend
Learn about SSR, SPA, and how to use Leaf with your favorite frontend framework.

Auth in Leaf MVC ​

Configuring Auth ​

What to read next ​

Routing

Handling Requests

Using Databases

Frontend

Auth in Leaf MVC

Configuring Auth

What to read next