Implement user authentication in Laravel

Use Laravel starter kits or an existing authentication flow, retrieve the current user, protect routes, and manage login and logout sessions safely.

Guance Editorial Team 2026-10-27 3 min read Updated 2026-10-27

Best practices

Illustration of application infrastructure and operations

For a new application, choose a starter kit supported by your Laravel major version. Laravel 13 documents React, Vue, Svelte, and Livewire options. In an existing application, integrate the framework's authentication services and middleware with your established flow.

Reading the current user does not implement login. Registration, credential verification, sessions, recovery, and route protection are separate parts of the flow.

Start a new application with a starter kit

With the Laravel installer already installed:

laravel new example-app
cd example-app
npm install
npm run build

Select the intended kit during the installer prompts. Configure a dedicated development database before running php artisan migrate, which changes the database schema. Check the chosen kit's documented features rather than assuming all kits provide the same interface or options.

Breeze is a lighter scaffold associated with earlier application setups. Jetstream is a separate package, not a step that simply adds features on top of generated Breeze code. Evaluate version support and optional features such as teams independently. Do not run a generator over an existing application's files without reviewing its changes.

Retrieve the authenticated user

Through the Auth facade:

use Illuminate\Support\Facades\Auth;

$user = Auth::user(); // User model, or null when unauthenticated
$id = Auth::id();

Inside a controller method with an injected Request:

use Illuminate\Http\Request;

public function show(Request $request)
{
    $user = $request->user();
}

Or in a protected route in routes/web.php:

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;

Route::get('/profile', function (Request $request) {
    return $request->user()->only(['name', 'email']);
})->middleware('auth');

Protect routes with middleware

// With DashboardController and Route imported:
Route::middleware(['auth'])->group(function () {
    Route::get('/dashboard', [DashboardController::class, 'index']);
});

For ordinary browser requests, an unauthenticated user is generally redirected to login. Requests expecting JSON normally receive an unauthenticated response instead. Use the guard appropriate to the application; auth:sanctum requires Sanctum to be installed and configured and is not a universal replacement for every API authentication scheme.

Customize credential-based login

Inside an existing controller, after validating inputs:

use Illuminate\Support\Facades\Auth;

if (Auth::attempt(['email' => $email, 'password' => $password], $remember)) {
    $request->session()->regenerate();
    return redirect()->intended('/dashboard');
}

This is a fragment, not a complete login endpoint. The surrounding flow still needs validation, login throttling, CSRF protection for session-based forms, failure handling, and suitable cookie settings. Regenerate the session after successful authentication to address session fixation. Let Laravel's supported password hashing services verify stored hashes; do not substitute MD5 or SHA-1 password comparisons.

For logout, clear authentication and invalidate session state:

Auth::logout();
$request->session()->invalidate();
$request->session()->regenerateToken();

Frequently asked questions

Should I choose Breeze or Jetstream?

First check the Laravel version and each package's support range. Existing applications may continue with their established stack; new applications should evaluate the currently documented starter kits rather than relying on an old installation recipe.

Can I use an existing users table?

Yes, with the correct user provider, guard, model mapping, and credential fields. The user model must implement the required authentication contract. Auth::attempt() verifies credentials; Auth::login($user) marks an already trusted user instance as authenticated and does not verify a password for you.

Why is Auth::user() null after login?

Check the guard and whether session middleware applies to the route. Inspect cookie domain, transport, and session configuration. For a separate SPA, configure Sanctum's documented stateful-cookie flow or an appropriate token flow; API routes do not gain a browser session merely because the user logged in elsewhere.