Authentication Routes - Sistema de Abogados

Overview

The authentication system is built using Laravel Breeze and provides a complete authentication scaffold including login, password reset, email verification, and session management.

Registration routes are currently disabled in this application. New users must be created through the admin panel.

Guest Routes

These routes are only accessible to unauthenticated users. Authenticated users will be redirected away from these routes. Middleware: guest

Route::get('login', [AuthenticatedSessionController::class, 'create'])
    ->name('login');

Method	URI	Route Name	Controller	Description
GET	`/login`	`login`	`AuthenticatedSessionController@create`	Display the login form

Response: Returns the login view with email and password fields.

Route::post('login', [AuthenticatedSessionController::class, 'store']);

Method	URI	Route Name	Controller	Description
POST	`/login`	-	`AuthenticatedSessionController@store`	Authenticate user and create session

Request Parameters:

email (string, required) - User’s email address
password (string, required) - User’s password
remember (boolean, optional) - Remember me checkbox

Response:

Success: Redirect to intended page or dashboard
Failure: Redirect back with validation errors

Registration Routes (Disabled)

Registration routes are currently commented out. Users must be created by administrators through the admin panel.

// Route::get('register', [RegisteredUserController::class, 'create'])
//     ->name('register');

// Route::post('register', [RegisteredUserController::class, 'store']);

If you need to enable registration, uncomment these routes in routes/auth.php.

Password Reset Routes

Request Password Reset Link (Disabled)

// Route::get('forgot-password', [PasswordResetLinkController::class, 'create'])
//     ->name('password.request');

// Route::post('forgot-password', [PasswordResetLinkController::class, 'store'])
//     ->name('password.email');

Password reset request routes are currently commented out. Contact your administrator for password resets.

Reset Password Form

Route::get('reset-password/{token}', [NewPasswordController::class, 'create'])
    ->name('password.reset');

Method	URI	Route Name	Controller	Description
GET	`/reset-password/{token}`	`password.reset`	`NewPasswordController@create`	Display password reset form

URL Parameters:

token (string) - Password reset token from email

Query Parameters:

email (string) - User’s email address

Process Password Reset

Route::post('reset-password', [NewPasswordController::class, 'store'])
    ->name('password.store');

Method	URI	Route Name	Controller	Description
POST	`/reset-password`	`password.store`	`NewPasswordController@store`	Reset user password

Request Parameters:

token (string, required) - Password reset token
email (string, required) - User’s email address
password (string, required) - New password
password_confirmation (string, required) - Password confirmation

Response:

Success: Redirect to login with success message
Failure: Redirect back with validation errors

Authenticated Routes

These routes require authentication and are only accessible to logged-in users. Middleware: auth

Email Verification Routes

Email Verification Notice

Route::get('verify-email', [EmailVerificationPromptController::class, '__invoke'])
    ->name('verification.notice');

Method	URI	Route Name	Controller	Description
GET	`/verify-email`	`verification.notice`	`EmailVerificationPromptController@__invoke`	Display email verification notice

Purpose: Shows a notice to users who have not yet verified their email address.

Verify Email

Route::get('verify-email/{id}/{hash}', [VerifyEmailController::class, '__invoke'])
    ->middleware(['signed', 'throttle:6,1'])
    ->name('verification.verify');

Method	URI	Route Name	Controller	Middleware	Description
GET	`/verify-email/{id}/{hash}`	`verification.verify`	`VerifyEmailController@__invoke`	`signed`, `throttle:6,1`	Verify user’s email address

URL Parameters:

id (integer) - User ID
hash (string) - Verification hash

Additional Middleware:

signed - Ensures the URL has a valid signature
throttle:6,1 - Limits to 6 attempts per minute

Response:

Success: Redirect to dashboard
Failure: Redirect to verification notice

Resend Verification Email

Route::post('email/verification-notification', [EmailVerificationNotificationController::class, 'store'])
    ->middleware('throttle:6,1')
    ->name('verification.send');

Method	URI	Route Name	Controller	Middleware	Description
POST	`/email/verification-notification`	`verification.send`	`EmailVerificationNotificationController@store`	`throttle:6,1`	Resend verification email

Additional Middleware:

throttle:6,1 - Limits to 6 attempts per minute

Response:

Success: Redirect back with status message
Already verified: Redirect to dashboard

Password Confirmation Routes

Show Password Confirmation Form

Route::get('confirm-password', [ConfirmablePasswordController::class, 'show'])
    ->name('password.confirm');

Method	URI	Route Name	Controller	Description
GET	`/confirm-password`	`password.confirm`	`ConfirmablePasswordController@show`	Display password confirmation form

Purpose: Used before sensitive operations to confirm the user’s identity.

Process Password Confirmation

Route::post('confirm-password', [ConfirmablePasswordController::class, 'store']);

Method	URI	Route Name	Controller	Description
POST	`/confirm-password`	-	`ConfirmablePasswordController@store`	Confirm user’s password

Request Parameters:

password (string, required) - User’s current password

Response:

Success: Redirect to intended page
Failure: Redirect back with validation errors

Update Password Route

Route::put('password', [PasswordController::class, 'update'])->name('password.update');

Method	URI	Route Name	Controller	Description
PUT	`/password`	`password.update`	`PasswordController@update`	Update user’s password

Request Parameters:

current_password (string, required) - User’s current password
password (string, required) - New password
password_confirmation (string, required) - Password confirmation

Response:

Success: Redirect back with success message
Failure: Redirect back with validation errors

Logout Route

Route::post('logout', [AuthenticatedSessionController::class, 'destroy'])
    ->name('logout');

Method	URI	Route Name	Controller	Description
POST	`/logout`	`logout`	`AuthenticatedSessionController@destroy`	Log user out and destroy session

Response: Redirect to login pageSecurity Note: Logout is a POST request to prevent CSRF attacks.

Authentication Flow

User Login

User submits email and password via POST to /login. Laravel authenticates credentials and creates a session.

Email Verification

If email is not verified, user is redirected to /verify-email notice. User must click the verification link sent to their email.

Access Protected Routes

Authenticated and verified users can access routes protected by auth and verified middleware.

Session Management

Laravel maintains the user session. Session expires after inactivity or when user logs out.

Middleware Details

Guest Middleware

Route::middleware('guest')->group(function () {
    // Login, registration, password reset routes
});

The guest middleware:

Allows only unauthenticated users
Redirects authenticated users to the dashboard
Applied to login and registration routes

Auth Middleware

Route::middleware('auth')->group(function () {
    // Email verification, password management, logout routes
});

The auth middleware:

Requires user authentication
Redirects unauthenticated users to login page
Applied to all protected routes

Signed Middleware

Used on email verification routes to ensure URLs have valid signatures:

->middleware(['signed', 'throttle:6,1'])

Throttle Middleware

Rate limits requests to prevent abuse:

->middleware('throttle:6,1')  // 6 attempts per 1 minute

Session Configuration

Laravel Breeze uses session-based authentication:

Driver: Configured in config/session.php
Lifetime: Default 120 minutes
Remember Me: Extends session to 2 weeks
CSRF Protection: All POST routes require CSRF token

Always include the @csrf directive in your forms to prevent CSRF attacks:

<form method="POST" action="{{ route('login') }}">
    @csrf
    <!-- form fields -->
</form>

Common Authentication Examples

<form method="POST" action="{{ route('login') }}">
    @csrf
    
    <input type="email" name="email" value="{{ old('email') }}" required>
    @error('email')
        <span>{{ $message }}</span>
    @enderror
    
    <input type="password" name="password" required>
    @error('password')
        <span>{{ $message }}</span>
    @enderror
    
    <input type="checkbox" name="remember">
    
    <button type="submit">Log in</button>
</form>

Logout Form Example

<form method="POST" action="{{ route('logout') }}">
    @csrf
    <button type="submit">Log Out</button>
</form>

Checking Authentication in Controllers

use Illuminate\Support\Facades\Auth;

// Check if user is authenticated
if (Auth::check()) {
    // User is authenticated
}

// Get authenticated user
$user = Auth::user();

// Get user ID
$userId = Auth::id();

Protecting Routes in Blade Templates

@auth
    <!-- Shown only to authenticated users -->
@endauth

@guest
    <!-- Shown only to guests -->
@endguest

Security Best Practices

CSRF Protection

All POST, PUT, PATCH, and DELETE requests must include a CSRF token using the @csrf directive.

Password Hashing

Passwords are automatically hashed using bcrypt. Never store plain text passwords.

Rate Limiting

Sensitive routes like email verification and password reset are rate limited to prevent abuse.

Signed URLs

Email verification links use signed URLs to prevent tampering.

Troubleshooting

User cannot log in

Common causes:

Incorrect credentials
Email not verified (check verified middleware requirement)
Account disabled or deleted
Session configuration issues

Solution: Check user status in admin panel and verify email verification status.

Email verification not working

Common causes:

Email not configured properly in .env
Mail queue not running
Spam folder
Signed URL expired

Solution:

Check mail configuration in .env
Run php artisan queue:work if using queue
Manually verify user in database if needed

Session expires too quickly

Solution:

Increase session lifetime in config/session.php
Ensure user checks “Remember Me” during login
Check if server time is synchronized

CSRF token mismatch

Common causes:

Missing @csrf directive in form
Session expired
Multiple browser tabs

Solution:

Add @csrf to all forms
Increase session lifetime
Clear browser cookies and cache

Web Routes

Application routes with role-based access control

User Authentication

Learn about user authentication flows and session management

Roles & Permissions

Understand role-based access control and permissions

User Types

Explore different user roles and their capabilities

Models

Controllers

Routes

​Overview

​Guest Routes

​Login Routes

​Display Login Form

​Process Login

​Registration Routes (Disabled)

​Password Reset Routes

​Request Password Reset Link (Disabled)

​Reset Password Form

​Process Password Reset

​Authenticated Routes

​Email Verification Routes

​Email Verification Notice

​Verify Email

​Resend Verification Email

​Password Confirmation Routes

​Show Password Confirmation Form

​Process Password Confirmation

​Update Password Route

​Logout Route

​Authentication Flow

​Middleware Details

​Guest Middleware

​Auth Middleware

​Signed Middleware

​Throttle Middleware

​Session Configuration

​Common Authentication Examples

​Login Form Example

​Logout Form Example

​Checking Authentication in Controllers

​Protecting Routes in Blade Templates

​Security Best Practices

CSRF Protection

Password Hashing

Rate Limiting

Signed URLs

​Troubleshooting

​Related Documentation

Web Routes

User Authentication

Roles & Permissions

User Types

Build docs developers (and LLMs) love

Overview

Guest Routes

Login Routes

Display Login Form

Process Login

Registration Routes (Disabled)

Password Reset Routes

Request Password Reset Link (Disabled)

Reset Password Form

Process Password Reset

Authenticated Routes

Email Verification Routes

Email Verification Notice

Verify Email

Resend Verification Email

Password Confirmation Routes

Show Password Confirmation Form

Process Password Confirmation

Update Password Route

Logout Route

Authentication Flow

Middleware Details

Guest Middleware

Auth Middleware

Signed Middleware

Throttle Middleware

Session Configuration

Common Authentication Examples

Login Form Example

Logout Form Example

Checking Authentication in Controllers

Protecting Routes in Blade Templates

Security Best Practices

Troubleshooting

Related Documentation