evan-sims

Evan is a software engineer on the DX-SDKs team at Auth0, and his pronouns are He/Him. He's passionate about helping developers build great (and secure!) software, a big fan of PHP, Laravel, Symfony, and WordPress, and an avid FOSS contributor. Before joining Auth0, he created free and open-source software supporting humanitarian aid and citizen journalism efforts. Once upon a time, he worked as a technical designer in the video games industry; he's more focused on playing them these days. He loves reading, traveling, spending time outdoors with his partner, and writing his blog autobiographies in the third person.

SDK Engineer

Evan Sims

Integrate Auth0 in your Laravel applications with no code by using the new Laravel SDK.

[Laravel](https://laravel.com/) is a tremendously popular web application framework — with good reason! Now in its 10th generation, the framework has built up a robust and mature foundation that’s not just battle-tested but genuinely delightful to build applications with. Laravel has elevated the entire PHP experience to a new level thanks to its incredibly passionate developer community. These days it’s nearly become as synonymous with PHP as Rails has with Ruby. And with PHP running on [at least 80% of web servers](https://kinsta.com/blog/is-php-dead/), that’s a big deal. For a good reason, companies like Disney, Warner Brothers, Twitch, and The New York Times have embraced Laravel.

Auth0 has offered a Laravel SDK for many years — our first release dates back to 2014! A lot has changed since then, and like all our SDKs, we’ve evolved to fit the times and the community’s needs. Every new release is an opportunity to iterate, improve, and create a better developer experience.

Early last year, [we released v7 of our Laravel SDK](https://github.com/auth0/laravel-auth0/), which was a big one. We rewrote the SDK from the ground up to take advantage of [PHP 8](https://stitcher.io/blog/new-in-php-8) and [Laravel 9](https://kinsta.com/blog/laravel-9/) and restructured everything on top of our massively upgraded core [PHP SDK v8](https://github.com/auth0/auth0-php). For the first time, developers could integrate authentication with Auth0 in their Laravel apps in less than ten lines of code, and it was great!

But we wondered — what if you could do it with zero lines of code?

Over the last few months, we’ve been striving to create that experience for our Laravel developers, and as of [v7.8 release](https://github.com/auth0/laravel-auth0/releases/tag/7.8.0), we’ve reached that milestone (and so much more).


## With Great Power...

Laravel is a robust framework created to support practically any kind of application developers might want to build. It’s one of those rare frameworks that has managed to strike a harmonious balance between powerfully customizable and highly opinionated. And when it comes to something as critical to an application as authentication, if you’re going to tackle the subject, you better be sure you’re striking that same balance successfully. It should “just work” while also being flexible enough to mold to the most niche scenarios.

Admittedly in the past, our Laravel SDK has not always hit that mark on addressing those niches, particularly in supporting monolithic apps; that is, apps that serve JSON APIs with token-based authorization as well as modern frontends with session-based authentication, in the same codebase. The community asked us to create a better solution, but there were some technical hurdles to work through first.

Traditionally, our SDK exposed authentication through a single API, which made integration super simple but meant that, on occasion, developers had to figure out how to support some exotic use cases using just a single SDK configuration. It simply didn’t always work as elegantly as one would hope.

With v7.8, we went back to the drawing board to address this. We took a deep dive into the core of Laravel’s Authentication APIs, drilling into the framework’s source code, and began laying the groundwork for a whole new approach that let us support every type of application (yes, even those tricky monolithic apps!) in exciting new ways. We even learned some new tricks along the way!


## Real Artists Ship

Efforts toward these ends [began with 7.2](https://github.com/auth0/laravel-auth0/releases/tag/7.2.0), where we started working on the foundation of our new approach. We started by building the support we needed to do this right. We began by releasing support for native Laravel sessions, persistent session storage, and support for Laravel’s native caching APIs. We built experimental [Octane](https://laravel-news.com/laravel-octane-for-scale) support for supercharged applications. We improved reliability by achieving 100% code coverage and implemented mutation testing and triple-filtered static analysis to ensure we caught as many edge cases as possible. We cut a new release each month, bringing us closer to our new goal: a no-code solution that addresses all our customers' requests.

And today, finally, with 7.8, we’ve reached our goal. There’s so much to share, but we’ll distill it down to the headline features:


### Changing of the Guard(s)

With 7.8, we released two completely new Guards that leverage every aspect of Laravel’s powerful Authentication API. These new Guards — one for session-based authentication and the other for token-based endpoint authorization — enable support for applications of all types and use cases, finally addressing the demands of those monolithic app developers.

Previously, you had to write the following code:

```php
Route::middleware(['guard:auth0', 'auth0.authenticate'])->get('/messages', function () { 
    // ...
});
```

Today you just write as follows:

```php
Route::get('/messages', function () {
    //...
} })->middleware('auth'); 
```

We created a suite of new middleware and services that support using these Guards without any integration work within the application. There are no editing files, defining middleware, or Kernel changes; it just works. Authentication is immediately available, and any routes configured to use Laravel’s native `‘auth’` middleware for limiting access to authenticated sessions instantly work with Auth0. **Zero lines of code!**

Previously, you had to define your guards and provider...

```
// config/auth.config: 
return [ 
    'guards' => [ 
        'auth0' => [ 
            'driver' => 'auth0.guard', 
            'provider' => 'auth0-provider', 
        ]
    ],
    'providers' => [ 
        'auth0-provider' => [ 
            'driver' => 'auth0.provider', 
            'repository' => \Auth0\Laravel\Auth\User\Repository::class, 
        ]
    ],
];
```
...and modify the Kernel:

```php
// app/Http/Kernel.php: 
use Illuminate\Foundation\Http\Kernel as HttpKernel; 

class Kernel extends HttpKernel 
{
protected $middlewareGroups = [ 
    'web' => [ 
        \App\Http\Middleware\EncryptCookies::class, 
        \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class, 
        \Illuminate\Session\Middleware\StartSession::class, 
        \Illuminate\View\Middleware\ShareErrorsFromSession::class, 
        \App\Http\Middleware\VerifyCsrfToken::Class, 
        \Illuminate\Routing\Middleware\SubstituteBindings::Class, 
        \Auth0\Laravel\Auth\Guard::class, 
    ]; 
} 
// routes/web.php: 
use Auth0\Laravel\Http\Controllers\{Callback, Login, Logoutl}; 
Route::group(['middleware' => ['web', 'guard:auth0'], static function (): void {
    Route::get('/login', Login::class)->name('login'); 
    Route::get('/logout', Logout::class)->name('logout'); 
    Route::get('/callback', Callback::class)->name('callback');
    }); 
```

Today, this is all you need to do:

```php
// Nothing! 🎉
```

And for the first time, we now support Laravel’s powerful native Authorization API, which enables developers to write permissions-based gates and policies that can use Auth0’s RBAC with APIs for fine-grained access control.

This is what you had to write previously:

```php
Route::middleware(['guard:auth0', 'auth0.authenticate'])->group(function () { 
    Route::get('/messages', function () { 
        return response("You're authorized to read messages."); 
    })->can('auth0.authorize:read:messages'); 
}); 
```
Here is what you have to write today:

```php
Route::get('/messages', function () { 
    return response("You're authorized to read messages."); 
})->middleware('auth')->can('read:messages'); 
```

### Auth0 CLI: First-Class Configuration

To support these new guards, we completely reinvented our SDK configuration API — and ended up building something profoundly flexible and capable. Our new configuration API enables us to support an infinite number of Guard instances in memory at any given time, supporting every conceivable need a developer might have for their application’s authentication needs — which is particularly important for Octane applications.

Our goal with the new configuration API was to simplify the integration experience dramatically, taking a sometimes lengthy explanation process involving application configuration instructions and `.env` file editing down to just a few error-proof steps.

What we arrived at was a whole new configuration experience powered by the Auth0 CLI. The CLI is an exciting tool that guides developers in managing their tenants through an elegant command-line interface. It was a perfect fit for simplifying one of the biggest challenges of getting started with the SDK, so we baked in native support for the CLI. Now, the JSON expressed by the CLI can be used to directly configure an application’s Auth0 SDK integration. **For the first time, you can configure your tenant and SDK in a single command.** It’s pretty awesome!


### The Quickest of Quickstarts

We’re always looking for ways to improve a developer’s first experiences with our SDKs, and that all begins with the quickstart. These starter applications demonstrate how a developer can integrate base applications with fully functional authentication as efficiently as possible — ideally resulting in a working app in 5 minutes or less.

Now that we’ve achieved no-code and integrated the Auth0 CLI, developers can do this with their Laravel application in **less than a minute**.

We re-wrote our Laravel quickstarts from the ground up to showcase this new configuration approach and demonstrate these new features, which cut the length of our quickstart in half. We also reworked the GitHub repository so developers can use it as a starting template for new Laravel applications with a single command.

Want a fully functional Laravel 9 application with Auth0 authentication out of the box? You got it!

```
composer create-project auth0-samples/laravel
```

Ready to configure it? Done!

```
./auth0 apps create \ 
--name "My Laravel Application" \ 
--type "regular" \ 
--auth-method "post" \ 
--callbacks "http://localhost:8000/callback" \ 
--logout-urls "http://localhost:8000" \ 
--reveal-secrets \ 
--no-input \ 
--json > .auth0.app.json 
```

You have a ready-to-ship app with completely functional authentication and access control.

## Integration Comparison

Let's compare how you would have integrated Auth0 previously with how you do it today.

### The old-days integration

Previously, you should have started with the installation:

```
$ composer global require laravel/installer 
$ laravel new example-app 
$ cd example-app 
$ composer install 
$ composer require auth0/laravel 
```

Then, you should have created an application in the [Auth0 dashboard](https://manage.auth0.com/)...

![Setup — Auth0 Application Creation](https://images.ctfassets.net/23aumh6u8s0i/4QoFmUwS0wdwyaHrQe5Ynr/444d87da9a8fabb23ad449dbc83de48b/09_-_Setup___Auth0_Application_Creation.png)

...and configured it:

![Setup (Continued) — Auth0 Application Configuration](https://images.ctfassets.net/23aumh6u8s0i/S2eVoxkVBulc96Ei8KrOn/1f2c5d6eedcbea27533337c60ccfd644/10_-_Setup__Continued____Auth0_Application_Configuration.png)

Back to your application, you should have configured it with the Auth0 registration data:

```
AUTH0_DOMAIN="..." 
AUTH0_CLIENT_ID="..." 
AUTH0_CLIENT_SECRET="..." 
AUTH0_COOKIE_SECRET="..." 
AUTH0_AUDIENCE="..." 
```

You should have defined your Guards and provider:

```php
// conflg/auth.config: 
return [ 
    'guards' => [ 
        'auth0' => [ 
            'driver' => 'auth0.guard', 
            'provider' => 'auth0-provider', 
        ]
    ], 
    'providers' => [ 
        'auth0-provider' => [ 
            'driver' => 'auth0.provider', 
            'repository' => \Auth0\Laravel\Auth\User\Repository::class,
        ]
    ], 
];
```

You should have defined your middleware in the Kernel:

```php
// app/Http/Kernel.php: 
use Illuminate\Foundation\Http\Kernel as HttpKernel; 

class Kernel extends HttpKernel 
{
    protected $middlewareGroups = [ 
        'web' => [ 
            \App\Http\Middleware\EncryptCookies::class, 
            \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class, 
            \Illuminate\Session\Middleware\StartSession::class, 
            \Illuminate\View\Middleware\ShareErrorsFromSession::class, 
            \App\Http\Middleware\VerifyCsrfToken::Class, 
            \Illuminate\Routing\Middleware\SubstituteBindings::class, 
            \Auth0\Laravel\Auth\Guard::class,
        ];
} 
```

You should have added support for authentication...

```php
// routes/web.php: 
use Auth0\Laravel\Http\Controllers\fCallback, Login, Logout}; 

Route::group(['middleware' => ['web', 'guard:auth0'], static function (): void {
    Route::get('/login', Login::class)->name('login'); 
    Route::get('/logout', Logout::class)->name('logout'); 
    Route::get('/callback', Callback::class)->name('callback');
    }); 
```

...and optionally configure the application's routing:

```php
Route:middleware('guard:auth0', 'auth0.authenticatel)->group(function () { 
    Route::getr('/messages', function () { 
        return response("You're authorized to read messages."); 
    })->can('auth0.authorize:read:messages'); 
});
```

### Today's integration

With the new SDK, you integrate Auth0 in your Laravel application in two easy steps.

First step, create a new application:

```
$ composer create-project auth0-samples/laravel
```

Second step, configure your application through the Auth0 CLI:

```
./auth0 apps create \
--name "My Laravel Application" \
--type "regular" \
--auth-method "post" \
--callbacks "http://localhost:8000/callback" \
--logout-urls"http://localhost:8000"\
--reveal-secrets \
--no-input
--json > .auth0.app.json
```

Optionally, configure its routing this way:

```php
Route::get('/messages', function () { 
    return response("You're authorized to read messages."); 
})->middleware('auth')->can('readmessages'); 

```

## Conclusion

At Auth0, we never stop innovating, and our SDKs are absolutely no exception. With v7.8, we’ve achieved a powerful no-code integration, an incredibly streamlined configuration scheme powered by the Auth0 CLI, and we now offer our quickest quickstarts ever. We’re proud of our latest Laravel release, but more importantly, we’re excited to see what developers build with it. We wouldn’t have gotten here without the valuable feedback of our developer community, and we’re excited to continue building the future of authentication in Laravel together.


Authentication with Laravel: Raising the Bar with a No Code Future

5e074956ee8ba1fea26e30d28c190495?s=300 avatar

5e074956ee8ba1fea26e30d28c190495?s=300

Full stack developer creating content at Auth0. I love taking a deep dive into hard-to-understand concepts and creating content that makes them easier to grasp. In my free time you can usually find me reading, hanging out with my dogs, or curling in the squat rack.

Former Developer Content Manager

Holly Guevara

1097492785caf9ffeebffeb624202d8f?s=200 avatar

1097492785caf9ffeebffeb624202d8f?s=200

Prosper is a great speaker, community leader, open source hacker, technical consultant, and a fervent Developer Advocate. He is a full-stack software engineer who has worked on biometric, health and developer tools. Prosper recently co-founded a startup called Eden that’s focused on improving the quality of lives in Nigeria and currently leads the engineering team. He also co-founded forloop, the largest developer community in Africa.

Former Auth0 Employee

Prosper Otemuyiwa

Lumen is a PHP micro-framework built to deliver microservices and blazing fast APIs. Learn how to build and secure RESTful APIs with Lumen

Developing RESTful APIs with Lumen (A PHP Micro-framework)

Learn how to build a Laravel CRUD application that includes authentication.

<div class="alert alert-success alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Laravel 6.0 is out! Check out <a onclick="window.metricsLib.track('laravel6_crosspost')" href="https://auth0.com/blog/build-a-laravel-6-app-with-authentication/">Build a Laravel 6 CRUD App with Authentication</a> to learn what new things Laravel can do for you.</strong>
</div>

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>This blog post covers Laravel 5.8.</strong>
</div>

**TL;DR:** Laravel is a great PHP framework. Currently, it is the most starred PHP project on [Github](https://github.com) and a lot of companies and people all over the world use it to build amazing applications. In this tutorial, I'll show you how easy it is to build a web application with Laravel and add authentication to it without breaking a sweat. Check out the [repo](https://github.com/auth0-blog/laravel-got) to get the code.

---

**Laravel** is a free, open-source PHP framework designed for building web applications with an expressive and elegant syntax. **Laravel** has a high level of abstraction which shields the common developer from complex inner workings. **Laravel** saves you time and effort because it ships with a lot of features out of the box. These amazing features include:

* Database Migrations
* Eloquent ORM
* Authorization and Policies
* Scheduler
* Queuing

**Laravel** makes good use of already written and well-tested components from the PHP community. It is one of the few frameworks that comes with development environments such as [Homestead](https://laravel.com/docs/5.8/homestead) and [Valet](https://laravel.com/docs/5.8/valet). The [documentation](https://laravel.com/docs) is very detailed and there is a large community based around Laravel. Some of the notable communities are [laracasts.com](https://laracasts.com/discuss), [larajobs.com](https://larajobs.com/), [laravel-news.com](https://laravel-news.com/), [laravelpodcast.com](http://www.laravelpodcast.com/) and [larachat.co](https://larachat.co/).

<include src="TweetQuote" quoteText="Laravel is one of the few frameworks that actually with development environments such as Homestead"/>

We'll be building a simple character listing app with **Laravel 5.8**. Our app will simply list **10 Game of Thrones characters** and their real names. Once we add authentication to the app, all logged-in users will have the privilege of knowing these celebrity characters personally.

## Let's Get Started

Laravel utilizes [Composer](http://getcomposer.org/) to manage its dependencies. So, before using Laravel, make sure you have Composer installed on your machine. We can install Laravel by issuing the Composer `create-project` command in your terminal like so: `composer create-project --prefer-dist laravel/laravel GOT` or using the `laravel` installer.

It's faster to spin up a new app using the `laravel` command like so: `laravel new GOT`. Check out the Laravel [docs](https://laravel.com/docs/5.8#installing-laravel) to learn how to set up the Laravel installer.

If you used the `laravel` installer command to create a new app, then you have to run `composer install` immediately after the previous command to install all the dependencies.

Now run the following in your terminal to launch your application:

```bash
php artisan serve
```

## Explore Directory Structure

Laravel applications follow the **Model-View-Controller** design pattern.

![Laravel app model view controller architecture diagram](https://images.ctfassets.net/23aumh6u8s0i/4CbISa5h2k6Op4g7Hp6DrQ/7478ae9f2bbdb66bec115642ce827137/mvc-diagram)

*(Source: [Self Taught Coders](https://selftaughtcoders.com))*

In a nutshell,

  * **Models** query your database and return the necessary data.
  * **Views** are pages that render data
  * **Controllers** handle user requests, retrieve data from the models, and pass them to the views.

Read more about [MVC](http://www.tomdalling.com/blog/software-design/model-view-controller-explained/) here.

The app directory is the **meat** of your Laravel application. It houses the following directories:

  * `Console` - Contains all your Artisan commands
  * `Http` - Contains all your controllers, middleware, requests, and routes file
  * `Providers` - Contains all your application service providers. You can read more about [Service Providers](https://laravel.com/docs/5.8/providers) here
  * `Events` - Contains all your event classes
  * `Exceptions` - Contains your application exception handler and custom exception classes
  * `Jobs` - Contains all the jobs queued by your application
  * `Listeners` - Contains all the handler classes for your events
  * `Policies` - Contains the authorization policy classes for your application. Policies are used to determine if a user can perform a given action against a resource.

The other directories namely:

  * `boostrap` contains your framework autoloading files and generated cache files
  * `config` contains your app's configuration files
  * `database` contains your database migrations and seeds
  * `public` contains your assets (images, JavaScript, css, etc.)
  * `resources` contains your views and localization files
  * `storage` contains all your compiled Blade templates, file caches, and logs
  * `tests` contains all your tests
  * `vendor` contains your app dependencies


## Setting Up The Controller

Open up your terminal and in the project root directory, run the command below to create a `ListController`.

```bash
php artisan make:controller ListController
```

Open up `app/Http/Controllers/ListController.php` and configure it like so:

```php
<?php

namespace App\Http\Controllers;

class ListController extends Controller
{
    public function show()
    {
       $characters = [
         'Daenerys Targaryen' => 'Emilia Clarke',
         'Jon Snow'           => 'Kit Harington',
         'Arya Stark'         => 'Maisie Williams',
         'Melisandre'         => 'Carice van Houten',
         'Khal Drogo'         => 'Jason Momoa',
         'Tyrion Lannister'   => 'Peter Dinklage',
         'Ramsay Bolton'      => 'Iwan Rheon',
         'Petyr Baelish'      => 'Aidan Gillen',
         'Brienne of Tarth'   => 'Gwendoline Christie',
         'Lord Varys'         => 'Conleth Hill'
       ];

       return view('welcome')->withCharacters($characters);
    }
}
```

`view('welcome')->withCharacters($characters)` indicates that we are passing the `$characters` array to a view called `welcome.blade.php`. We'll create that view later in this post.

## Setting Up The Model

Laravel models are stored by default in the root of the `app` directory. The `User` model ships with the Laravel framework. Only the `User` model is needed in this application so we won't create any additional models. However, if you want to create more models, you can simply run the command below like so:

```bash
php artisan make:model <modelName>
```

where `<modelName>` represents the name of the model you want to create.

## Setting Up The Routes

Open up `routes/web.php` and configure it like so:

```php
/*
|--------------------------------------------------------------------------
| Application Routes
|--------------------------------------------------------------------------
|
| Here is where you can register all of the routes for an application.
| It's a breeze. Simply tell Laravel the URIs it should respond to
| and give it the controller to call when that URI is requested.
|
*/

Route::get('/', 'ListController@show');
```

Once a request hits the `/` route, it invokes the `show` method of the `ListController` and renders the returned value in the `welcome` view. We'll configure the `welcome` view later in this post.

## Setting Up Authentication

We're going to be using Auth0 for authentication. Setting up the built-in authentication with Laravel is pretty **straightforward, but limited**. With Auth0, you'll have access to an easy-to-use dashboard, the ability to integrate social identity providers, two-factor authentication, passwordless login, and more. And luckily, it's just as easy to integrate with your Laravel application! Let's check it out.

If you don't already have an account, go ahead and <a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account here</a>.

<include src="SignupCTA" text="Try out the most powerful authentication platform for free." linkText="Get started →" />

After you've signed up, head to the dashboard and click on "Applications". Click on "Create Application" and name the application "Laravel App" or anything you'd like. Then click on "Regular Web Application" and press create.

Next, you need to add the valid callback URLs and logout URLs in the dashboard.

Click on "Applications" and select the application you just created (or the default one). Next, click on "Settings".

Update these values as follows:

* Allowed callback URLs: `http://localhost:8000/auth0/callback`
* Logout URLs: `http://localhost:8000`

Next, go back to your terminal and install the [Auth0 PHP plugin](https://github.com/auth0/auth0-PHP) and [Auth0 Laravel plugin](https://github.com/auth0/laravel-auth0):

```bash
composer require auth0/login:"~5.0"
```

Now open the `config/app.php` file and add the Auth0 login service provider to the list of providers:

```php
// ...
'providers' => [
    // ...
    Auth0\Login\LoginServiceProvider::class,
];
```

Then scroll down to the `aliases` array and add the Auth0 facade:

```php
// ...
'aliases' => [
    // ...
    'Auth0' => Auth0\Login\Facade\Auth0::class,
];
```

Next, open `app/Providers/AppServiceProvider.php` and add the following under `register()`:

```php
// ...
class AppServiceProvider extends ServiceProvider
{
  // ...
  public function register()
  {
    $this->app->bind(
      \Auth0\Login\Contract\Auth0UserRepository::class,
      \Auth0\Login\Repository\Auth0UserRepository::class
    );
  }
}
```

You need to publish the plugin configuration. In your terminal, run:

```bash
php artisan vendor:publish
```

When it asks which file you'd like to publish, select `Auth0\Login\LoginServiceProvider`.

This will create the `config/laravel-auth0.php` file. Open this up now and you'll see it's using some Auth0 variables. These are sensitive, so you need to add them to the `.env` file.

Open up `.env` and add:

```
AUTH0_DOMAIN=your-auth0-domain.auth0.com
AUTH0_CLIENT_ID=your-client-id
AUTH0_CLIENT_SECRET=your-client-secret
```

To fill in these values, head back to [your Auth0 dashboard](https://manage.auth0.com/dashboard/), select your application, and click on "Settings".

While you have `.env` open, double-check that `APP_URL` matches your dev URL exactly, **including the port**. It should say `APP_URL=http://localhost:8000`. If not, update that now.

The last configuration step is to switch out the Laravel user driver to use Auth0.

Open up `config/auth.php`, scroll down to `providers`, and paste in:

```php
'providers' => [
  'users' => [
    'driver' => 'auth0',
  ],
],
```

Now that you have the Auth0 plugin configured, you just need to integrate it into the application.

### Integrating Auth0

Open up `routes/web.php` and add these authentication routes:

```php
Route::get( '/auth0/callback', '\Auth0\Login\Auth0Controller@callback' )->name( 'auth0-callback' );
Route::get( '/login', 'Auth\Auth0IndexController@login' )->name( 'login' );
Route::get( '/logout', 'Auth\Auth0IndexController@logout' )->name( 'logout' )->middleware('auth');
```

These routes will handle the login, logout, and redirect to Auth0 during login. Now you need to create that `Auth0IndexController`.

In your terminal, run:

```bash
php artisan make:controller Auth/Auth0IndexController
```

Open up `app/Http/Controllers/Auth/Auth0IndexController.php` and replace it with:

```php
<?php

namespace App\Http\Controllers\Auth;

use Illuminate\Http\Request;
use App\Http\Controllers\Controller;

class Auth0IndexController extends Controller
{
  /**
    * Redirect to the Auth0 hosted login page
    *
    * @return mixed
    */
  public function login()
  {
    $authorize_params = [
      'scope' => 'openid profile email',
    ];
    return \App::make('auth0')->login(null, null, $authorize_params);
  }

  /**
    * Log out of Auth0
    *
    * @return mixed
    */
  public function logout()
  {
    \Auth::logout();
    $logoutUrl = sprintf(
      'https://%s/v2/logout?client_id=%s&returnTo=%s',
      env('AUTH0_DOMAIN'),
      env('AUTH0_CLIENT_ID'),
      env('APP_URL'));
    return  \Redirect::intended($logoutUrl);
  }
}
```

The scopes being requested in the `login()` function are: `openid`, `profile`, and `email`.

There is also a `logout()` function that will clear all session data to log the user out.

Now it's time to wire up the buttons so that users can sign in and out.

Open up your `welcome.blade.php` and configure it like so:

``` html  

<!DOCTYPE html>
<html lang="{{ str_replace('_', '-', app()->getLocale()) }}">
  <head>
      <meta charset="utf-8">
      <meta name="viewport" content="width=device-width, initial-scale=1">
      <title>Laravel</title>
  </head>
  <body>
    <div class="flex-center position-ref full-height">
      @if (Route::has('login'))
      <div class="top-right links">
        @if(Auth::user())
          <a href="{{ url('/home') }}">Home</a>
          <a href="{{ url('/logout') }}">Logout</a>
        @else
          <a href="{{ route('login') }}">Login</a>
        @endif
      </div>
      @endif
      <div class="container">
        <div class="row">
          <div class="col-md-10 col-md-offset-1">
            <div class="panel panel-success">
              <div class="panel-heading">List of Game of Thrones Characters</div>
              @if(Auth::user())
              
              <table class="table">
                <tr>
                  <th>Character</th>
                  <th>Real Name</th>
                </tr>
                @foreach($characters as $key => $value)
                  <tr>
                  <td>{{ $key }}</td><td>{{ $value }}</td>
                  </tr>
                @endforeach
              </table>
              @endif
            </div>
            @if(Auth::guest())
            <a href="/login" class="btn btn-info"> You need to login to see the list 😜😜 >></a>
            @endif
          </div>
        </div>
      </div>
    </div>
  </body>
</html>

```

Here, we are looping through the `$characters` array data passed from the `ListController` for appropriate rendering in the `welcome` view.

`Auth::user()` &mdash; You can check if a user is authenticated or not via this method from the `Auth` Facade. It returns true if a user is logged-in and false if a user is not. Check [here](https://laravel.com/docs/5.8/facades) for more about how Facades work in Laravel.

`Auth::guest()` &mdash; This does the opposite of `Auth::user()`. It returns true if a user is not logged in and false if a user is logged in. Check [here](https://laravel.com/api/5.8/Illuminate/Auth/Guard.html) to see all the methods you can call on the `Auth` Facade.

Now that we have all the routes and views setup, your application should look like this:

_Landing Page_

![Laravel application localhost home page](https://images.ctfassets.net/23aumh6u8s0i/1mO2iyeAn8ijE7WmOUkuxz/929a7e2a22b698b17c28357653fc4578/landing-page)

If you were to implement authentication on your own, you might have a login and register page like this:

_Login Page_

![Laravel login page](https://images.ctfassets.net/23aumh6u8s0i/7q90WhvMPGyPqhh5XfG15z/e77f3d9251c3c15102f6066159a7690d/login-page)

_Register Page_

![Laravel register page](https://images.ctfassets.net/23aumh6u8s0i/6ac6bOkZkfTwvseGxCMFO0/897b07d6843f752d742867817baf6a6e/register-page)

Because we're using Auth0 for authentication, our application will redirect users to the Auth0 login page, so you don't have to create these on your own!

## Using the Auth Middleware

Middlewares provide a convenient mechanism for filtering HTTP requests entering your application. For example, **Laravel** includes a middleware that verifies the user of your application is authenticated. If the user is not authenticated, the middleware will redirect the user to the login screen. However, if the user is authenticated, the middleware will allow the request to proceed further. The `app/Http/Middleware` directory contains several middleware.

Let's check out how the `auth` middleware works.

Add a new route to your `routes/web.php` file like so:

```php
Route::get('/got', [
  'middleware' => ['auth'],
  'uses' => function () {
    echo "You are allowed to view this page!";
}]);
```

If you're still logged in, head to [http://localhost:8000/got](http://localhost:8000/got) and you should get the message "You are allowed to view this page!". Now, log out, then try to access that route and you will be redirected back to Auth0 to sign in. 

The Laravel `auth` middleware intercepted the request, checked if the user was logged-in, discovered that the user was not logged-in, then redirected the user back to the `login` route, which sent them to Auth0.

## Wrapping Up

Well done! You have just built your first app with Laravel. Laravel is an awesome framework to work with. It focuses on simplicity, clarity and getting work done. As we saw in this tutorial, you can easily activate the built-in authentication to your Laravel applications. If you find yourself needing more, you can also integrate Auth0 just as easily.

Please, let me know if you have any questions or observations in the comment section. 😊

Creating Your First Laravel App and Adding Authentication

Learn how to build and secure an API with Laravel.

Build and Secure a Laravel API

olususi-oluyemi

Oluyemi is a tech enthusiast with a background in Telecommunication Engineering. He ventured into programming with a keen interest in solving day-to-day problems encountered by users. He has since directed his problem-solving skills towards building software for both the web and mobile platforms. As a full-stack software engineer with a passion for sharing knowledge, Oluyemi has published many technical articles and content on several blogs worldwide. As s tech-savvy person, his hobbies include trying out new programming languages and frameworks.

Software Engineer / Technical Content Creator

Olususi Oluyemi

Learn how to test Laravel APIs using PHPUnit.

Testing Laravel APIs Using PHPUnit

Learn about the new features and changes in the latest Laravel 8 release.




It feels like just yesterday we were reading about what's coming in Laravel 6. And here we are today, learning about what's new in Laravel 8! 🤯

Whether you're getting started with Laravel or just want to check out the [latest and greatest](https://laravel.com/docs/8.x/releases), keep on reading.

## Laravel Jetstream

[Laravel Jetstream](https://jetstream.laravel.com/1.x/introduction.html), the new Laravel application scaffolding, was released with the new version of Laravel.

Jetstream provides a fantastic starting point for your Laravel applications with the following built-in options:

- Login and registration
- Email verification
- Two-factor authentication (2FA)
- Session management
- [Laravel Sanctum](https://laravel.com/docs/8.x/sanctum) API support
- Designed with Tailwind CSS
- Choice of two frontend stacks: [**Livewire + Blade**](https://laravel-livewire.com/) or [**Inertia.js + Vue.js**](https://inertiajs.com/)

![Laravel Jetstream Livewire installation](https://images.ctfassets.net/23aumh6u8s0i/5bC4p3YLjRj30EO0VlIRSs/aa91442260d3618589c60fcd808383f6/laravel-jetstream-livewire)

### How to use Laravel Jetstream

You can create a new application with Jetstream using the [Laravel installer](https://laravel.com/docs/8.x/installation#installing-laravel). Make sure the Laravel installer is updated to `v4.0`, and then run the following:

``` bash  
laravel new your-project --jet
```

Choose which stack you want to use: Livewire or Inertia. Next, run your database migrations with:

``` bash  
php artisan migrate
```

Finally, see your application at [`http://localhost:8000`](http://localhost:8000) by running:

``` bash  
php artisan serve
```

And now, you're ready to [explore your new Laravel Jetstream application](https://jetstream.laravel.com/1.x/installation.html)!

If you'd prefer to use Composer, you can find the [Composer installation instructions](https://jetstream.laravel.com/1.x/installation.html#composer-installation) in the Laravel Jetstream documentation.

## Models Updates

### Welcome back, `Models` directory!

The `app/Models` directory is back! Years ago, when Laravel 5 launched, a lot of developers noticed the `Models` directory was missing. Instead, new models were created directly in the `app` directory. Surprisingly, this caused quite the uproar in the community. You could still manually create the folder, and a lot of developers did, but it was considered an extra nuisance by some.

With Laravel 8, the beloved `app/Models` directory has been restored! If you prefer the old structure, you can always modify your codebase to remove the `Models` directory again.

### Model factory classes

[Taylor Otwell](https://github.com/taylorotwell) spent some time rewriting the Eloquent model factories as classes.

Let's compare the changes by looking at the default `User` factories from both Laravel 7 and 8. 

**User factory in Laravel 7.x:**

``` php  
// database/factories/UserFactory.php

use Faker\Generator as Faker;
use Illuminate\Support\Str;

$factory->define(App\User::class, function (Faker $faker) {
    return [
        'name' => $faker->name,
        'email' => $faker->unique()->safeEmail,
        'email_verified_at' => now(),
        'password' => '$2y$10$92IXUNpkjO0rOQ5byMi.Ye4oKoEa3Ro9llC/.og/at2.uheWG/igi', // password
        'remember_token' => Str::random(10),
    ];
});
```

**User factory in Laravel 8:**

``` php  
// database/factories/UserFactory.php

namespace Database\Factories;

use App\Models\User;
use Illuminate\Database\Eloquent\Factories\Factory;
use Illuminate\Support\Str;

class UserFactory extends Factory
{
    /**
     * The name of the factory's corresponding model.
     *
     * @var string
     */
    protected $model = User::class;

    /**
     * Define the model's default state.
     *
     * @return array
     */
    public function definition()
    {
        return [
            'name' => $this->faker->name,
            'email' => $this->faker->unique()->safeEmail,
            'email_verified_at' => now(),
            'password' => '$2y$10$92IXUNpkjO0rOQ5byMi.Ye4oKoEa3Ro9llC/.og/at2.uheWG/igi', // password
            'remember_token' => Str::random(10),
        ];
    }
}
```

In Laravel 8, factories are now classes that extend the base Laravel factory class. Glancing at the default file, you'll see the `model` property and `definition` method. The `definition` method then returns the model attributes.

Compare this to Laravel 7 and below, where the `UserFactory` is defined with a [Closure](https://www.php.net/manual/en/class.closure.php) and returns the specified model attributes.

Both of these still have access to Faker, as expected. Let's look at the difference between *using* factories in Laravel 7 versus Laravel 8.

**Using factories in Laravel 7:**

Before this update, you would use the `factory` helper function in your seeder files to generate model instances.

``` php  
// database/seeds/UserSeeder.php

class UserSeeder extends Seeder
{
  /**
  * Run the database seeds.
  *
  * @return void
  */
  public function run()
  {
    // Create three App\User instances
    $users = factory(App\User::class, 3)->create();
  }
}
```

**Using factories in Laravel 8:**

With Laravel 8, you can use the `factory` directly on the model instance. This is because the default models now include a `HasFactory` trait, as shown in the simplified code below. 

``` php  
// database/seeders/UserSeeder.php

class UserSeeder extends Seeder
{
  /**
    * Run the database seeds.
    *
    * @return void
    */
  public function run()
  {
    // Create three App\User instances
    User::factory(3)->create();
  }
}
```

``` php  
// app/Models/User.php
<?php
namespace App\Models;

use Illuminate\Database\Eloquent\Factories\HasFactory;
// ...

class User extends Authenticatable
{
    use HasFactory;
    // ...
}

```

> ❗ If you have existing factories on a Laravel 7.x project or older and you're planning on upgrading, you can use the [`laravel/legacy-factories`](https://github.com/laravel/legacy-factories) package that was created to simplify the upgrade process.

## Migration Squashing

😱 Laravel 8 introduces another exciting feature: migration squashing! No longer do you have to scroll for five minutes when you open up your `migrations` folder! With migration squashing, you can now condense your migration files into a single SQL file with the following commands:

``` bash  
php artisan schema:dump
php artisan schema:dump --prune
```

Laravel will write the new `schema` file to `database/schema`. Then when you run your migrations, Laravel will run the SQL from the schema file first before moving on to anything created later in the `migrations` folder.

> Note: Migration squashing is currently only supported for MySQL and Postgres.

## Job Batching

In Laravel, jobs are tasks that can be performed as part of a queue to accomplish something in the background. The new [job batching feature](https://laravel.com/docs/8.x/queues#job-batching) allows you to execute several [jobs](https://laravel.com/docs/8.x/queues#creating-jobs) together.

To use the new batching feature, first define your job as you normally would. The example below has been simplified to show the new `Batchable` trait.

``` php  
<?php
namespace App\Jobs;

use Illuminate\Bus\Batchable;
// ...

class SendEmail implements ShouldQueue
{
  use Batchable;

  /**
    * Execute the job.
    *
    * @return void
    */
  public function handle()
  {
    if ($this->batch()->cancelled()) {
      // Detected cancelled batch...

      return;
    }
    // Batched job executing...
  }
}
```

Once you have your job defined, you can dispatch a batch of jobs in your controller using the `batch` method of the `Bus` facade.

``` php  
  use App\Jobs\SendEmail;
  use App\User;
  use Illuminate\Bus\Batch;
  use Illuminate\Support\Facades\Batch;
  use Throwable;

  $batch = Bus::batch([
    new SendEmail(User::find(1)),
    new SendEmail(User::find(2)),
    new SendEmail(User::find(3)),
  ])->then(function (Batch $batch) {
    // All jobs completed successfully...
  })->catch(function (Batch $batch, Throwable $e) {
    // First batch job failure detected...
  })->finally(function (Batch $batch) {
    // The batch has finished executing...
  })->dispatch();

  return $batch->id;
```

You'll also notice the addition of the `then`, `catch`, and `finally` methods. You can use these to define completion callbacks for your batch of jobs.

## Better Rate Limiting


**Rate limiting in Laravel 7**

``` php  
Route::middleware('auth:api', 'throttle:10,1')->group(function () {
  Route::get('/login', function () {
    //
  });
});
```

**Rate limiting in Laravel 8**

In Laravel 8, you can define your rate limiters in `app/Providers/RouteServiceProvider.php` using the `for` method of the `RateLimiter` facade. The `for` method will accept a name and a Closure, which returns the rate limiting details that you set up. 

``` php  
use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Support\Facades\RateLimiter;

RateLimiter::for('login', function (Request $request) {
  return Limit::perMinute(10);
});
```

You can now apply this pre-configured rate limiter to routes with `throttle:` followed by the rate limiter name.

``` php  
Route::middleware(['throttle:login'])->group(function () {
  Route::post('/login', function () {
    //
  });
  Route::post('/register', function () {
    //
  });
});
```

> Note: The `throttle` middleware API from previous Laravel versions will still remain functional.

For more about rate limiting options, see the [Laravel routing docs](https://laravel.com/docs/8.x/routing#rate-limiting). 

## Maintenance Mode

Laravel 8 also brings some improvements to maintenance mode. Maintenance mode is a really helpful feature that allows you to "disable" your application while you're making updates to it.

In previous versions, you would have to specify the IPs that would still be allowed to access the application with the `allow` option:

``` bash  
php artisan down --allow=127.0.0.1 --allow=192.168.0.0/16
```

With Laravel 8, you no longer need to allow certain IPs explicitly. Instead, you can use the `secret` option to create a maintenance mode bypass token:

``` bash  
php artisan down --secret="1630542a-246b-4b66-afa1-dd72a4c43515"
```

You can then access your application while in maintenance mode by appending the token to your application's URL, e.g., `https://example.com/1630542a-246b-4b66-afa1-dd72a4c43515`. The bypass cookie will be saved to your browser, and you can continue navigating your application from its normal URL, e.g., `https://example.com`.

## Routing Namespacing

In Laravel 8, the `namespace` property in `app/Providers/RouteServiceProvider.php` is now `null` by default, as you can see below.

``` php  
// app/Providers/RouteServiceProvider.php
<?php

namespace App\Providers;

// ...
class RouteServiceProvider extends ServiceProvider
{
    // ...
    /**
     * If specified, this namespace is automatically applied to your controller routes.
     *
     * In addition, it is set as the URL generator's root namespace.
     *
     * @var string
     */
    protected $namespace = null; // <--- LARAVEL 8 CHANGE
    // ...
}
```

In previous versions, the `$namespace` property was set to `App\Http\Controllers`.

This change means that controller route definitions will no longer include automatic namespace prefixing. The example below demonstrates how routing namespacing differs between Laravel 7 and Laravel 8.

**Laravel 7:**

``` php  
// routes/web.php

Route::get('/posts', 'PostController@index'); 
```

**Laravel 8:**

``` php  
// routes/web.php
use App\Http\Controllers\PostController;

Route::get('/posts', [PostController::class, 'index']);
```

If you prefer the old way, you can change the `$namespace` value back to `App\Http\Controllers` in `app/Providers/RouteServiceProvider.php`.

For more about routing namespacing updates, see the [Laravel routing documentation](https://laravel.com/docs/8.x/routing#basic-routing).

## Wrap Up

As always, Taylor Otwell and the rest of the Laravel team have been hard at work to deliver us some awesome and welcome updates to Laravel! Now that you have some background about what's new and what changed with Laravel 8, feel free to go off and [explore on your own](https://laravel.com/docs/8.x)! Leave a comment below letting me know your favorite change in Laravel 8 and what you're planning on building. Cheers!

<include src="asides/AboutAuth0" />


What's New in Laravel 8?

Learn how to build and secure a travel manager CRUD application with Laravel.

Build a Laravel CRUD App with Authentication

Learn about the new features and products in the recent Laravel 6.0 release.

What's New in Laravel 6.0?

andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

Learn how to develop GraphQL APIs with Laravel and how to secure them with Auth0.

Developing and Securing GraphQL APIs with Laravel

Laravel 5.7 has just been released! What's new? What improvements were made? Learn how to build better PHP applications with this new release.



**TL;DR:** **Laravel 5.7** is a major release to, at time of writing, the most popular PHP framework on GitHub. Furthermore, [Laravel Nova](https://nova.laravel.com) was also released. In this article, I'll cover the new features in Laravel 5.7 and several other changes and deprecations.

<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">🎊 Laravel 5.7.0 has been released! Includes support for email verification, guest policies, dump-server, improved console testing, notification localization and more! <a href="https://t.co/DIISmfm5oP">https://t.co/DIISmfm5oP</a> 🎊</p>&mdash; Laravel (@laravelphp) <a href="https://twitter.com/laravelphp/status/1036971212449243136?ref_src=twsrc%5Etfw">September 4, 2018</a></blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>


## What's new in Laravel 5.7?

### 1. Symfony Dump Server Integration

Marcel Pociot, authored a package called [laravel-dump-server](https://github.com/beyondcode/laravel-dump-server). This package provides you a dump server, that collects all your `dump` call outputs. It's inspired by [Symfony's Var-Dump Server](https://symfony.com/doc/current/components/var_dumper.html#the-dump-server).

Laravel 5.7 now officially ships with the _laravel_dump-server_ package and makes it available via the Artisan command:

```bash
php artisan dump-server
```

All `dump` calls will be displayed in the console window once the server has started.

![Laravel - Symfony Dump Server Integration](https://images.ctfassets.net/23aumh6u8s0i/6ZdDoNQrq8O2YAJG94bCoA/3b99720eb2119591f1d8546e4fc8f73d/laravel-dump-server)
_Source: murze.be_

### 2. Better Support For Filesystem

Laravel 5.7 ships with two new methods for reading and writing streams in the filesystem. They are `readStream` and `writeStream` methods for reading and writing streams respectively as shown in the example below:

```php
Storage::disk('s3')->writeStream(
    'new-package.zip',
    Storage::disk('local')->readStream('local-package.zip')
);
```

### 3. Improved Artisan Command Testing

Laravel 5.7 provides a better approach for testing artisan commands.

<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">ICYMI Last week a new PR was merged into laravel 5.7 with a neat way for testing Artisan commands, check details here: <a href="https://t.co/36f9FbAhBI">https://t.co/36f9FbAhBI</a> <a href="https://t.co/pLC3sVLrJP">pic.twitter.com/pLC3sVLrJP</a></p>&mdash; Mohamed Said🐋 (@themsaid) <a href="https://twitter.com/themsaid/status/1033954657226420224?ref_src=twsrc%5Etfw">August 27, 2018</a></blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>

Check out the example below:

This is an Artisan command:

```php
Artisan::command('hackathon-starter:init', function () {
    $project = $this->ask('What type of project do you want to build?');

    $this->line('Initializing...');

    $answer = $this->choice('Which language do you program in?', [
        'pwa-on-steroids',
        'pwa-normal',
        'pwa-on-fire',
    ]);

    $this->line('Installing...');
});
```

You may now test the command above with the slick test approach below:

```php
/**
 * Test a console command.
 *
 * @return void
 */
public function test_console_command()
{
    $this->artisan('hackathon-starter:init')
         ->expectsQuestion('What type of project do you want to build?', 'PWA')
         ->expectsOutput('Initializing..')
         ->expectsQuestion('Please specify the type of PWA', 'pwa-on-fire')
         ->expectsOutput('Installing...')
         ->assertExitCode(0);
}
```


<include src="TweetQuote" quoteText = "Laravel 5.7 provides a better approach for testing artisan commands."/>

### 4. Multi-Lingual Support for Notifications

In Laravel 5.7, you can now send notifications in other locales, apart from the current language.

The `Illuminate\Notifications\Notification` class offers a `locale` method that can be invoked to set the preferred language.

```php
  $user->notify((new EmailSent($email))->locale('zh'));
```

```php
  Notification::locale('zh')->send($users, new EmailSent($email));
```

### 5. Paginator

By default, Laravel provides three links on each side of the primary paginator links.

In Laravel 5.7, there's a new option, `onEachSide`, to enable customization of the number of links displayed on both sides.

``` html  

 {{ $paginator->onEachSide(7)->links() }}

```

### 6. More Options for Guest Policies

By default, authorization gates and policies return _false_ for guest visitors to your application. In this new release, you can now allow unauthenticated visitors to pass through authorization checks by declaring an "optional" type-hint or supplying a `null` default value for the user argument.

```
Gate::define('modify-sheet', function (?User $user, Sheet $sheet) {
    // ...
});
```

### 7. Optional Email Verification

Laravel 5.7 provides an optional email verification feature. An `email_verified_at` timestamp column has to be added to the user's table migration for this feature to work as intended.

If you want new users to verify their email, the `User` model needs to implement the `MustVerfifyEmail` interface.

```php
<?php

namespace App;

use Illuminate\Notifications\Notifiable;
use Illuminate\Contracts\Auth\MustVerifyEmail;
use Illuminate\Foundation\Auth\User as Authenticatable;

class User extends Authenticatable implements MustVerifyEmail
{
    // ...
}
```

The newly registered users will receive an email containing a signed verification link. Once the user clicks the link, the app will automatically update the database and redirect the user to the intended location.

This feature also ships with a `verified` middleware for situations where you need to protect certain app routes from only verified members.

```php
  'verified' => \Illuminate\Auth\Middleware\EnsureEmailIsVerified::class,
```

### 8. Better Support for Development Errors

**Joseph Silber** submitted a PR that allows Laravel 5.7 to provide a clear and concise message when a non-existent method is called on a model.

<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">Ever mistyped a method on an Eloquent model and got a cryptic error saying that the method doesn&#39;t exist *on the query builder* 😳<br><br>Well, in <a href="https://twitter.com/laravelphp?ref_src=twsrc%5Etfw">@laravelphp</a> 5.7 you&#39;ll now get a clear, concise message saying that the method doesn&#39;t exist on the model 👌<a href="https://t.co/uKAxbIVdmv">https://t.co/uKAxbIVdmv</a> <a href="https://t.co/aWgQ8zr2ak">pic.twitter.com/aWgQ8zr2ak</a></p>&mdash; Joseph Silber (@joseph_silber) <a href="https://twitter.com/joseph_silber/status/1028768236417036288?ref_src=twsrc%5Etfw">August 12, 2018</a></blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>

### 9. URL Generator & Callable Syntax

Laravel 5.7 now supports callable array syntax for controller actions that generate URLs.

_Before Laravel 5.7_

```php
$url = action('FoodController@index');

$url = action('FoodController@view', ['id' => 1]);
```

_Now_

```php
$url = action([FoodController::class, 'index']);

$url = action([FoodController::class, 'view'], ['id' => 1]);
```

### 10. Laravel Nova

Taylor already announced that he was working on a project several months ago. The long awaited project called **[Laravel Nova](https://nova.laravel.com)** has been released. Nova is a beautifully designed administration panel for Laravel. It offers support for filters, lenses, actions, queued actions, metrics, authorization, custom tools, custom cards, custom fields, etc.

![Laravel Nova](https://images.ctfassets.net/23aumh6u8s0i/2kxoN45cHorsLSHZgmzhij/509a5bbd27bba13bc0293ca7d57db1cc/screenshot)
_Laravel Nova_


<include src="TweetQuote" quoteText = "As if Laravel 5.7 wasn't enough, @taylorotwell formally introduced @laravel_nova, a beautifully designed administration panel for Laravel."/>

## Deprecations and Other Updates

* The _resources/assets_ directory has been flattened into _resources_.

Check out other [Laravel 5.7 updates on GitHub](https://github.com/laravel/framework/releases/tag/v5.7.0).

## Upgrading to Laravel 5.7

Laravel 5.7 requires `PHP >= 7.1.3`. And the estimated upgrade time from Laravel `v5.6` is about ten to fifteen minutes.

Check out this [comprehensive upgrade guide](https://laravel.com/docs/master/upgrade#upgrade-5.7.0). However, if you don't want to be bothered about manually configuring and changing files for the upgrade, I recommend using [Laravel Shift - A service that provides automated, instant Laravel upgrade services by an army of thorough bots and friendly humans](https://laravelshift.com).

<include src="asides/LaravelBackend" />

## Conclusion

**Laravel 5.7** PHP framework came loaded with new features and significant improvements. And **Nova** is a product every Laravel developer should try out!

Have you upgraded to Laravel v5.7 yet? What are your thoughts? Let me know in the comments section! 😊

<include src="TweetQuote" quoteText = "Laravel 5.7 has been released! Learn what's new in the most popular PHP framework"/>


Laravel 5.7 Release: What's New? 10 Features To Try

shahid-mansuri

Guest Author

Shahid Mansuri

Out of the box, Laravel ships with many features that make your applications ready for prime time. In this article, you will learn about these features.

**TL;DR:** Laravel makes your applications more secure by default, which makes it the recommended PHP framework for mission-critical applications. In this article, we will briefly address how Laravel can help you create mission-critical, production-ready applications.

## Introduction

For a mission-critical application, there are two levels of security that matters: application security and server security. [Laravel](https://laravel.com/) is a development framework and, as such, it won't make your server more secure, just your application.

Laravel features allow you to use everything securely. All the data is sanitized where needed unless you're using Laravel with raw queries. Then, you're on your own basically. The point is, Laravel gives you security for common vulnerabilities.

So, in this article, you will learn about the most important security features of Laravel.

<include src="TweetQuote" quoteText="Learn why Laravel is the best PHP framework for mission-critical, production-ready applications."/>

## Protecting Laravel Applications from SQL Injection

Laravel protects you from [SQL injection](https://www.w3schools.com/sql/sql_injection.asp) as long as you're using the [Fluent Query Builder](https://laravel.com/docs/5.6/queries) or [Eloquent](https://laravel.com/docs/5.6/eloquent).

Laravel does this by making prepared statements which are going to escape any user input that may come in through your forms. If hackers add a new input to a form, they may try to insert a quote and then run their own custom SQL query to damage or read your application database. However, this won't work since you are using Eloquent. Eloquent is going to escape this SQL command and the invalid query will just be saved as text into the database.

The take away is: if you're using the Fluent Query Builder or Eloquent, your application is safe from SQL injections.

> [To learn more about SQL injection protection on Laravel check out this article](https://www.easylaravelbook.com/blog/how-laravel-5-prevents-sql-injection-cross-site-request-forgery-and-cross-site-scripting/).

## Protecting Cookies on Laravel Applications

Laravel will also protect your cookies. For that, you will need to [generate a new Application Key](http://laravel-recipes.com/recipes/283/generating-a-new-application-key). If it’s a new project, use the PHP artisan `key:generate` command.

For existing projects running on Laravel 3, you will need to switch to a text editor, then go to your application's `config` directory and open the `application.php` file. There, you will find the key under the _Application Key_ section.

On Laravel 5 and above, _Application Key_ is called _Encryption Key_. You can find this key in the `app.php` file that resides in the `config` folder.

The Application Key or Encryption Key uses encryption and cookie classes to generate secure encrypted strings and hashes. It is extremely important that this key remains secret and should not be shared with anyone. Also, make it about 32 characters of random gibberish so that nobody can guess it as Laravel uses this key to validate the cookie.

As mentioned above, Laravel auto-generates the Application Key; however, if required, you can edit it from the `application.php` file.

The cookie class uses the Application key to generate secure encrypted strings and hashes. Laravel will protect your cookies by using a hash and making sure that no one tampers with them.

## Cross-Site Request Forgery (CSRF) Protection on Laravel

To protect your application from a <a href="https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)">CSRF attack</a>, Laravel uses the Form Classes Token method, which creates a unique token in a form. So, if you look at the source code of a target form, you will see a hidden form field called CSRF token.

``` html  

<form name="test">
{!! csrf_field() !!}

</form>

```


The token makes sure that the request is coming from your application and not from somewhere else. With that token, you need to make sure that it's checking for a forged request. Laravel has CSRF-protection enabled by default.

Laravel adds a pre-defined CSRF filter in your app that looks like this:

```php
<?php
Route::filter('csrf', function() {
   if (Session::token() != Input::get('_token')) {
       throw new Illuminate\Session\TokenMismatchException;
   }
});
```

The CSRF filter allows you to check for a forged request and if it has been forged, it's going to return an HTTP 500 error. You can use the Form Classes Token method and CSRF filter together to protect your application routes.

## Mass Assignment Vulnerabilities on Laravel

[Object-relational mapping tools](https://en.wikipedia.org/wiki/Object-relational_mapping) (like Eloquent) have the ability to mass-assign properties directly into the database, which is a security vulnerability.

For those who don’t know, Laravel’s ORM (Eloquent) offer a simple Active-Record implementation for working with your database. Each database table has a corresponding `Model_Class` that interacts with that table.

Mass assignment let you set a bunch of fields on the model in a single go, rather than sequentially, something like:

```php
$user = new User(Input::all());
```

> The command above sets all value at the same time, in one go.

For example, your application can have a user table and with a user_type field. This field can have values of: `user` or `admin`.

In this case, you don’t want your users to update this field manually. However, the above code could allow someone to inject a new `user_type` field. After that, they can switch their account to `admin`.

By adding to the code:

```php
$fillable = array('name', 'password', 'email');
```

You make sure only the above values are updatable with mass assignment.

To be able to update the `user_type` value, you need to explicitly set it on the model and save it, as shown here:

```php
$user->user_type = 'admin';
$user->save();
```

## Cross-Site Scripting Protection on Laravel

Laravel's `@{{}}` syntax will escape any HTML objects that are the part of a view variable. It’s a big-deal, considering that a malevolent user can authorize the subsequent string into a comment or user profile:

``` html  

My list <script>alert("spam spam spam!")</script>

```

![Avoiding cross-site scripting attacks on Laravel applications.](https://images.ctfassets.net/23aumh6u8s0i/5WdHccVg4StxK9Jb49ij9i/870d71697172c76da3f89b0a915f2f31/xss)

Without <a href="https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)">cross-site scripting</a> protection, a view variable like the one above would be presented in a web page in the form of an annoying alert window, causing this form of attack called cross-site scripting. This may sound like a minor exasperation associated with more erudite attacks which might hasten the user to supply some bank information via a JavaScript model which are afterward sent to third-party websites.

Fortunately, when a variable is rendered within the `@{{}}` escape tags, Laravel will render in its place a string as the following one:

``` html  

My list &lt;script&gt;alert("spam spam spam!")&lt;/script&gt;

```

This makes Laravel applications immune to this type of attack.

![Laravel applications are immune to cross-site scripting attacks.](https://images.ctfassets.net/23aumh6u8s0i/7xUbSMIc5Lk3AbaeYVoee6/f4cd107e4f6fb1dde34153fe2efe39b0/no-xss)

<include src="TweetQuote" quoteText="With Laravel, you can rest assured that the most common attacks will be handled by default."/>

<include src="asides/LaravelBackend" />

## Conclusion

As you may know, there are other things you must do to protect your mission-critical applications, such as disabling verbose error reporting to stop sensitive details about your application being made visible to a bad actor. Nevertheless, Laravel ensures a much more secure application by protecting again these common attack vectors, reducing the attack surface out-of-the-box.

Laravel is one of the reasons behind the renewed interest in the PHP developer community. Using a more secure base application and following the familiar model–view–controller (MVC) architectural pattern, it's popularity grew fast. As a free, open-source framework, created by [Taylor Otwell](https://twitter.com/taylorotwell) and based on Symfony, Laravel took over as the defacto framework within a few years of its introduction.

Why Laravel is the Recommended Framework for Secure, Mission-Critical Applications

Laravel 5.6 has officially been released. What's new? What improvements were made? Learn how to build better PHP applications with this new release.



---

**TL;DR:** On Wednesday, February 7, 2018, **Laravel 5.6**, was released to the public. It's a major release to the most popular PHP framework on GitHub as of this writing. Furthermore, [Spark 6.0](https://spark.laravel.com) was also released alongside **Laravel 5.6**. According to the policy laid down by the Taylor and the core team, major Laravel framework releases are released every six months (February and August). In this article, I'll cover the new features in Laravel 5.6 and several other changes and deprecations.

---

Laravel is the most popular, open-source PHP framework as of this writing. It is designed for building web applications with an expressive and elegant syntax. With Laravel, application development is fast because it ships with a lot of features out of the box. Without further ado, let's dive right into **Laravel 5.6**.

## What's new in Laravel 5.6?

### 1. Support For Argon Password Hashing

Argon2, the recommended password hashing algorithm by the [Password Hashing Competition](http://password-hashing.net), is a modern algorithm for securely hashing passwords. And it comes in two distinct flavors, Argon 2i and Argon 2d. PHP 7.2 recently added support for Argon 2i password hashing. Therefore, [Michael Lundbol](https://github.com/morloderex) took the initiative to add support for Argon hashing in Laravel.

![Argon Password Hashing Support](https://images.ctfassets.net/23aumh6u8s0i/5L2DynjxdZyyidmafRBIGB/520c2ffe34b5298eb7e67b62379f7cca/argon)
_Initiative to add Argon Password Hashing_

The `bcrypt` driver is the default driver for password hashing in Laravel. However, Laravel 5.6 now supports `argon`.

![Config File for Hashing](https://images.ctfassets.net/23aumh6u8s0i/2UxXTOybvNMutMq0CSUuMb/09a2461f07e263e59a2311c91a061c1a/argondriversupport)
_Config file for hashing_

**Note:** Laravel 5.6 ships with a [hashing config file](https://github.com/laravel/laravel/blob/develop/config/hashing.php) as displayed above.

### 2. Better Support For Dynamic Rate Limiting

One of the beautiful built-in features of Laravel is _API Rate Limiting_. Before now, Laravel's rate limiting configuration involved specifying a hard-coded number of requests on a group of routes. However, Laravel 5.6 adds icing to the cake by allowing you specify a maximum number of requests based on an authenticated User model attribute.

```php
Route::middleware('auth:api', 'throttle:rate_limit,1')->group(function () {
    Route::get('/users', function () {
        // do something awesome
    });
});
```

In the code above, the `rate_limit` parameter is an attribute of the `User` model in a Laravel 5.6 application.

### 3. Model Serialization on Steriods

Before now, there was a persistent bug on queued models. When queued models are finally processed, it's without their loaded relationships in place.

In Laravel 5.6, huge improvements have been made to ensure that relationships loaded on queued models are automatically re-loaded when the job is processed by the queue.

### 4. Improved Logging

There is a new [logging config](https://github.com/laravel/laravel/blob/develop/config/logging.php) file in Laravel 5.6. In this file, you can set up logging stacks that send log messages to various handlers.

Check out the example below:

```php
'channels' => [
  'stack' => [
      'driver' => 'stack',
      'channels' => ['syslog', 'slack'],
  ],

  'syslog' => [
      'driver' => 'syslog',
      'level' => 'debug',
  ],

  'slack' => [
      'driver' => 'slack',
      'url' => env('LOG_SLACK_WEBHOOK_URL'),
      'username' => 'Laravel Log',
      'emoji' => ':boom:',
      'level' => 'critical',
  ],
],
```

The `stack` driver allows you to combine multiple channels, in this case, `syslog` and `slack`, into a single log channel as shown above.

Furthermore, with the `tap` array on a channel's configuration, you can easily customize Monolog for an existing channel like so:

```php
'single' => [
    'driver' => 'single',
    'tap' => [App\Logging\CustomizeFormatter::class],
    'path' => storage_path('logs/laravel.log'),
    'level' => 'debug',
],
```

**Note:** Monolog is a library that sends your application logs to files, sockets, inboxes, databases and various web services. It's a comprehensive library with various log handlers.

Check out more [information on Logging in Laravel 5.6](https://laravel.com/docs/5.6/logging).

### 5. Single Server Task Scheduling

Before now, if your app ran on multiple servers and the task scheduler was active on those servers, then your scheduled tasks also executed multiple times. However, in Laravel 5.6, you can now schedule your task to execute on just a single server if your app runs on multiple servers.

<include src="TweetQuote" quoteText=" In Laravel 5.6, you can now schedule your task to execute on just a single server if your app runs on multiple servers."/>

```php
$schedule->command('launch:flasheavy')
         ->tuesdays()
         ->at('12:00')
         ->onOneServer();
```

### 6. Beautiful Error Reporting With Collision

[Collision](https://github.com/nunomaduro/collision) is an awesome package developed and maintained by [Nuno Maduro](https://twitter.com/enunomaduro). It is a detailed, beautiful and intuitive error handler for console/command-line PHP applications.

Laravel 5.6 now ships with Collision via the `dev` composer dependency. When working with your Laravel app via the command line, Collision provides an awesome error reporting interface like so:

![Collision Integration](https://images.ctfassets.net/23aumh6u8s0i/5WAEpSxPY66GW98BjUjqKT/8ef48bc254ac36c22540813347e7d23e/collision)
_Collision Integration with Laravel 5.6_

### 7. Elevated Eloquent Date Formatting

Laravel 5.6 provides a subtle way to cast Eloquent date model attributes to a specific date format. All you need to do is to specify the desired date format in the `$casts` array.

<include src="TweetQuote" quoteText="Laravel 5.6 provides a subtle way to cast Eloquent date model attributes to a specific date format."/>

Now, you can customize the date model attributes like so:

```php
protected $casts = [
  'date_enrolled' => 'date:Y-m-d',
  'date_evicted' => 'datetime:Y-m-d H:00',
];
```

When the model is cast to JSON or array output, the attributes will be formatted to the date formats example provided above like so:

```bash
date_enrolled: 2005-02-19
date_evicted: 2018-02-20 8:30
```

### 8. Aliasing Blade Components For Easier Access

This feature is very handy. Accessing a blade component in a sub-directory is easier via aliasing. With the component method, you can alias `components.card` to `card` assuming the card component's directory is `resources/views/components/card.blade.php`.

```php
Blade::component('components.card', 'card');
```

Once it has been aliased, you can invoke the component like so:

```php
@card
  This is your Valentine card.
@card
```

### 9. Broadcasting Channel Classes

In Laravel 5.6, you can now generate broadcasting channel classes via the `make:channel` Artisan command. The generated channel class will be placed in the `App/Broadcasting` directory.

```bash
php artisan make:channel PurchaseChannel
```

Registering the channel is as easy as calling the `Broadcast::channel` method below in the `routes/channel.php` file:

```bash
use App\Broadcasting\PurchaseChannel;

Broadcast::channel('purchase.{purchase}', PurchaseChannel::class);
```

In the `PurchaseChannel` class, you can add the authorization logic in the `join` method. Before now, the authorization logic was placed in the channel authorization Closure.

```php
<?php

namespace App\Broadcasting;

use App\User;
use App\Purchase;

class PurchaseChannel
{

  ....

  /**
   * Authenticate the user's access to the channel.
   *
   * @param  \App\User  $user
   * @param  \App\Purchase $purchase
   * @return array|bool
   */
  public function join(User $user, Purchase $purchase)
  {
      return $user->id === $purchase->user_id;
  }
}
```
### 10. Daring Upgrade Of Symfony Components and Bootstrap

All the Symfony components used by Laravel 5.6 have been bumped to the `~4.0` release. Furthermore, all the front-end scaffolding of Laravel 5.6 and Spark 6.0 has been bumped to `v4`.

I covered all the [major additions and deprecations of Bootstrap 4 in this article](https://auth0.com/blog/whats-new-in-bootstrap4).

## Deprecations and Other Updates

* Generating an API resource controller can now be done by using the `--api` switch when executing the `make:controller` command.
* Laravel 5.6 introduced helper methods, `Arr::wrap()`, `classes_uses_recursive()`, `Str::uuid()`, and `Str::orderedUuid()`, the latter generating a timestamp first UUID that's more easily and efficiently indexed by databases like MySQL.
* PHPUnit, upgraded to v7.
* Laravel Mix, upgraded to v2.
* The deprecated Artisan `optimize` command has been removed.
* Added support for customizing the mail message building in `ResetPassword::toMail()`.
* Add `policies()` method to `AuthServiceProvider` to retrieve all the policies defined by the provider.
* Two new blade directives have been added to the framework, `@csrf` and `@method`.
* Support for PostgreSQL comments was added. Furthermore, Laravel 5.6 now has better support for enumeration columns.

Check out other [Laravel 5.6 updates here](https://github.com/laravel/framework/releases/tag/v5.6.0).

## Upgrading to Laravel 5.6

Laravel 5.6 requires `PHP >= 7.1.3`. And the estimated upgrade time from Laravel `v5.5` is about ten to thirty minutes.

Check out this [comprehensive upgrade guide](https://laravel.com/docs/5.6/upgrade). However, if you don't want to be bothered about manually configuring and changing files for the upgrade, I recommend using [Laravel Shift - A service that provides automated, instant Laravel upgrade services by an army of thorough bots and friendly humans](https://laravelshift.com).

![Laravel Shift](https://images.ctfassets.net/23aumh6u8s0i/35hQnVliNvBtSA4KxrMoXL/f3d875e8dcbf6ac8bc5494c1dfd2f8f6/laravelshift)
_Laravel Shift_

<include src="asides/LaravelBackend" />

## Conclusion

**Laravel 5.6** came loaded with new features and significant improvements. Another major release will be out by August and some of the features shipping with the next major release will be unleashed at [Laracon 2018](http://laracon.us). Get your tickets already!

Have you upgraded to Laravel v5.6 yet? What are your thoughts? Let me know in the comments section! 😊


Laravel 5.6 Release: What's New?

Learn how to deploy PHP applications on different platforms.

The Ultimate Guide To Deploying Your PHP Applications

Learn how to build your first AdonisJs application and add authentication to it.

Creating your first app with AdonisJs and adding authentication

Laravel 5.3 is here. Learn more and get caught up on all the news coming out of Laracon US 2016.



Day Two of the  [Laravel US Conference](http://laracon.us/) consisted of more talks and workshops. Seven speakers took to the stage, and we had the first soft talk of the conference. Check out our [recap of Day One](https://auth0.com/blog/laracon-summary-day-1/) to learn about the Laravel 5.3 overview by Taylor Otwell and the technical workshops that happened on the first day.

**[Evan You](https://twitter.com/youyuxi)** was back again with another live demo on *Single-Page Applications with Vue, Vue Router & Vuex*. He demonstrated the importance of Vuex to Vuejs in relation to Redux with React. Check out the slides for his Vue.js workshop [here](https://docs.google.com/presentation/d/1wZWkSkMBsPtUmiGY8T4MnjCZ6xaKjElkK1MjJoj9C48/edit#slide=id.p).

<blockquote class="twitter-tweet" data-partner="tweetdeck"><p lang="en" dir="ltr">In Vue devtools, you can actually export the state of your app as a json file to send to another developer 😱😱😱😱😱😱 <a href="https://twitter.com/hashtag/Laracon?src=hash">#Laracon</a></p>&mdash; Prosper Otemuyiwa (@unicodeveloper) <a href="https://twitter.com/unicodeveloper/status/758668716808761344">July 28, 2016</a></blockquote>

**[Jack McDade](https://twitter.com/jackmcdade)** presented the first soft talk of the conference. His presentation was on *Wizards, Lawnmowers, and Hovercrafts*. Very insightful presentation about product design, people culture, and work perspectives. Check out the slides [here](https://speakerdeck.com/jackmcdade/wizards-lawnmowers-and-hovercrafts).

<blockquote class="twitter-tweet" data-partner="tweetdeck"><p lang="en" dir="ltr">Failure is an EVENT not a person. <a href="https://twitter.com/jackmcdade">@jackmcdade</a> at <a href="https://twitter.com/hashtag/laracon?src=hash">#laracon</a></p>&mdash; John Kary (@johnkary) <a href="https://twitter.com/johnkary/status/758678689953349632">July 28, 2016</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>

<blockquote class="twitter-tweet" data-partner="tweetdeck"><p lang="en" dir="ltr">You don&#39;t need to wait for managers and execs to change company culture. Start with yourself <a href="https://twitter.com/jackmcdade">@jackmcdade</a> <a href="https://twitter.com/hashtag/laracon?src=hash">#laracon</a> <a href="https://t.co/yiazTsSg00">pic.twitter.com/yiazTsSg00</a></p>&mdash; Wade Urry (@iWader) <a href="https://twitter.com/iWader/status/758678224188510208">July 28, 2016</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>

**Note:** Of all the presenters today, he had the finest slides!

**[Ben Ramsey](https://twitter.com/ramsey)**, creator of the popular [UUID PHP library](https://github.com/ramsey/uuid) covered a lot about the history of HTTP and HTTP/2. He talked about the challenges and processes that occurred from the initial version of HTTP up until HTTP/2 came about. Check out the slides [here](https://speakerdeck.com/ramsey/http-is-dead-long-live-http2-laracon-2016). **HTTP is Dead. Long live HTTP/2!**

<blockquote class="twitter-tweet" data-partner="tweetdeck"><p lang="en" dir="ltr">No more image sprites or inline images with HTTP2 <a href="https://twitter.com/hashtag/laracon?src=hash">#laracon</a></p>&mdash; Michael Dyrynda (@michaeldyrynda) <a href="https://twitter.com/michaeldyrynda/status/758697391167897600">July 28, 2016</a></blockquote>

<blockquote class="twitter-tweet" data-partner="tweetdeck"><p lang="en" dir="ltr">The new HTTP 👇👇👇👇 <a href="https://twitter.com/hashtag/Laracon?src=hash">#Laracon</a> <a href="https://t.co/MLMrgXnYWN">pic.twitter.com/MLMrgXnYWN</a></p>&mdash; Prosper Otemuyiwa (@unicodeveloper) <a href="https://twitter.com/unicodeveloper/status/758690621750177792">July 28, 2016</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>

<blockquote class="twitter-tweet" data-partner="tweetdeck"><p lang="en" dir="ltr">&quot;HTTP is dead&quot; simply means RFC 2616 is dead <a href="https://twitter.com/hashtag/Laracon?src=hash">#Laracon</a> <a href="https://t.co/xhuOrY42b1">pic.twitter.com/xhuOrY42b1</a></p>&mdash; Prosper Otemuyiwa (@unicodeveloper) <a href="https://twitter.com/unicodeveloper/status/758689045568520192">July 28, 2016</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>

**Note:** The sound of Ramsey's voice has a strong resemblance with that of Tom Hanks!

**[Zeev Suraski](https://twitter.com/zeevs)**, co-architect of PHP, talked about the *PHP 7 Story*. He talked about the history of PHP from the initial version up to PHP 7. He also highlighted benchmark performances of each major PHP version.

**Note:** Zeev is crazy about spicy foods!

**[Amanda Folson](https://twitter.com/AmbassadaorAwsum)**, developer advocate @ Gitlab. Her talk was on building APIs with Lumen. Check out the slides [here](https://speakerdeck.com/afolson/zero-to-api-with-lumen).

<blockquote class="twitter-tweet" data-partner="tweetdeck"><p lang="und" dir="ltr">Example Pokédex API by <a href="https://twitter.com/AmbassadorAwsum">@AmbassadorAwsum</a> with <a href="https://twitter.com/hashtag/LumenPHP?src=hash">#LumenPHP</a>. <a href="https://twitter.com/hashtag/pokemon?src=hash">#pokemon</a> <a href="https://twitter.com/hashtag/php?src=hash">#php</a> <a href="https://twitter.com/hashtag/laracon?src=hash">#laracon</a> <a href="https://twitter.com/hashtag/LaravelSF?src=hash">#LaravelSF</a> <a href="https://t.co/WqgVG5YCoG">pic.twitter.com/WqgVG5YCoG</a></p>&mdash; Paul Foryt (@pauly4it) <a href="https://twitter.com/pauly4it/status/758745145667747843">July 28, 2016</a></blockquote>

<blockquote class="twitter-tweet" data-partner="tweetdeck"><p lang="en" dir="ltr">It’s a good idea to hide id’s in API results — <a href="https://twitter.com/AmbassadorAwsum">@AmbassadorAwsum</a></p>&mdash; Laravel News (@laravelnews) <a href="https://twitter.com/laravelnews/status/758745219944685571">July 28, 2016</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>

**[Matthew Machuga](https://twitter.com/machuga)**, senior developer at *Think Through Math*, gave a talk on **Tests Should Tell a Story**. He gave some really good tips and tricks for testing, like the ones below:

* Write a failing test first
* Write the smallest amount of code
* Listen to feedback and refactor code and test in pieces.

He also talked about a **feature-first** approach in building software.

* Build only what your client needs at that moment
* Support slice plans
* Waste few resources to test and idea
* Provide readable, agreed-upon specs for stakeholders
* Encourage collaboration

Check out the slides [here](https://speakerdeck.com/machuga/tests-should-tell-a-story).

<blockquote class="twitter-tweet" data-partner="tweetdeck"><p lang="en" dir="ltr">When we&#39;re building software, we need to ask the stakeholders questions. Details, details, details! <a href="https://twitter.com/machuga">@machuga</a> <a href="https://twitter.com/LaraconUS">@LaraconUS</a> <a href="https://twitter.com/hashtag/Laracon?src=hash">#Laracon</a></p>&mdash; Caryn Humphreys (@LadyCarni) <a href="https://twitter.com/LadyCarni/status/758764162977705985">July 28, 2016</a></blockquote>

**[Sandi Metz](https://twitter.com/sandimetz)**, popular Rubyist and author of *Practical Object-Oriented Design in Ruby* gave a talk on **Get A Whiff of This**. She talked about the various types of code smells and a practical object-oriented approach in writing good code. She also mentioned that every code smell can be mapped to a recipe that cures it via refactoring. Check out the slides [here](https://speakerdeck.com/skmetz/get-a-whiff-of-this).

<blockquote class="twitter-tweet" data-partner="tweetdeck"><p lang="en" dir="ltr">I could seriously sit and listen to <a href="https://twitter.com/sandimetz">@sandimetz</a> talk about programming all day. This talk is _ultra_ illuminating. <a href="https://twitter.com/hashtag/Laracon?src=hash">#Laracon</a></p>&mdash; CS (@cschmitz81) <a href="https://twitter.com/cschmitz81/status/758781530072289282">July 28, 2016</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>

<blockquote class="twitter-tweet" data-partner="tweetdeck"><p lang="en" dir="ltr">&quot;Testing is like a canary in a coal mine. If your testing is hard that means your code is bad&quot; <a href="https://twitter.com/sandimetz">@sandimetz</a> <a href="https://twitter.com/hashtag/Laracon?src=hash">#Laracon</a> <a href="https://twitter.com/hashtag/whoa?src=hash">#whoa</a></p>&mdash; Jon (@jfarl5) <a href="https://twitter.com/jfarl5/status/758779731550605314">July 28, 2016</a></blockquote>

<blockquote class="twitter-tweet" data-partner="tweetdeck"><p lang="en" dir="ltr">“Code smell.” Does NOT mean “I don’t like the code you wrote and I can’t explain why.” <a href="https://twitter.com/sandimetz">@sandimetz</a></p>&mdash; Eric L. Barnes (@ericlbarnes) <a href="https://twitter.com/ericlbarnes/status/758773060182810624">July 28, 2016</a></blockquote>

**Note:** This is the first PHP conference Sandi has ever attended!

## Conclusion

Day Two of Laracon US has been awesome. Two speakers actually used Ruby code to drive home points in their presentations today. It amazingly brought a fresh perspective to the way we use code in the PHP land. I'll update this post as soon as I lay my hands on speaker slides that are currently not referenced here. There are seven speakers lined up for the final day of Laracon US 2016. There will be more technical talks and hopefully Taylor will unveil some other Laravel and open-source goodness!

I'll leave you with a list of additional resources and links to help you both learn Laravel and stay up to date with the latest news and announcements.

 * [Laravel news](https://laravel-news.com/) - Latest Laravel news, also maintains a live blog for Laracon
 * [Laracasts](https://laracasts.com/series/whats-new-in-laravel-5-3) - Learn everything about PHP and what's new in laravel 5.3
 * [Matt Stauffer's blog](https://mattstauffer.co/blog/series/new-features-in-laravel-5-3) - Learn about the latest Laravel 5.3 features

Laracon 2016 Summary - Day Two



The annual [Laravel US](http://laracon.us/) conference is upon us once again. Everyone is excited about the upcoming release of Laravel 5.3. Taylor Otwell and several Laravel Community members have been tweeting about changes and salient new features for weeks now.

In today's short post, we'll recap all the big announcements coming out of Laracon US 2016. Four incredible speakers mounted the stage today, and there were lots of wonderful moments all through their talks. Three of the speakers broke the *no live coding in a presentation* rule today and it was awesome!

**[Adam Wathan](https://twitter.com/adamwathan)** opened the Laravel Conference with his workshop on **Test Driven Laravel**. He literally created a simple twitter clone using test-driven development. Adam also talked about his new side project-[Building Robust Laravel applications with TDD](https://adamwathan.me/test-driven-laravel/). Like I said earlier, no slides, just live coding!

<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">Programming by Wishful thinking, Let the tests guard you - <a href="https://twitter.com/adamwathan">@adamwathan</a> <a href="https://twitter.com/hashtag/Laracon?src=hash">#Laracon</a> <a href="https://twitter.com/hashtag/TDDInLaravel?src=hash">#TDDInLaravel</a></p>&mdash; Prosper Otemuyiwa (@unicodeveloper) <a href="https://twitter.com/unicodeveloper/status/758293597892579328">July 27, 2016</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>

**[Evan You](https://twitter.com/youyuxi)** did a live demo on the new [Vuejs 2.0](https://vuejs.org/). Check out his slides for his Vue.js workshop [here](https://docs.google.com/presentation/d/16MpK3I2LZz47QdLg3uMNkCC3PqmM0znXF3-FdCEpics/edit#slide=id.g15faa8fa0f_0_60).

<blockquote>
    Every component can be seen as a ViewModel, connecting a piece of DOM and a piece of state - Evan You
</blockquote>

Want to learn how to build a Vuejs 2.0 app? Check [here](https://auth0.com/blog/2016/07/14/create-an-app-in-vuejs-2/). If you want to learn how to add authentication to a Vuejs app, check out our [quickstarts](https://auth0.com/docs/quickstart/spa/vuejs).

<include src="TweetQuote" quoteText="Re-rendering entire chunks of DOM is expensive and disruptive - Evan you"/>

**[Chris Fidao](https://twitter.com/fideloper)** covered a lot about **Servers for Hackers**. He talked about Security, Firewall, ipv6, iptables, and Supervision. All the things he talked about can be found on [serversforhackers.com](https://serversforhackers.com/). You can also get his [book](https://book.serversforhackers.com/). Check out his slides [here](https://speakerdeck.com/fideloper/server-survival). However, with [webtask](https://webtask.io/), you can write serverless apps. You don't need to worry about server provisioning and scaling, **Auth0** takes care of that for you!

<blockquote class="twitter-tweet" data-partner="tweetdeck"><p lang="en" dir="ltr">Sitting in <a href="https://twitter.com/fideloper">@fideloper</a>&#39;s presentation on server admin grok-ing stuff that the server admin at a prev job told me I wouldn&#39;t get. <a href="https://twitter.com/hashtag/laracon?src=hash">#laracon</a></p>&mdash; CS (@cschmitz81) <a href="https://twitter.com/cschmitz81/status/758381036027973636">July 27, 2016</a></blockquote>

<blockquote class="twitter-tweet" data-partner="tweetdeck"><p lang="en" dir="ltr">As a 20+ year SysAdmin, I can say that <a href="https://twitter.com/fideloper">@fideloper</a> is doing a fantastic job talking about all these server things in his talk at <a href="https://twitter.com/hashtag/Laracon?src=hash">#Laracon</a>.</p>&mdash; Bill Wheeler (@phpdreams) <a href="https://twitter.com/phpdreams/status/758377870704074756">July 27, 2016</a></blockquote>


**Note:** Chris actually smashed a spider on stage. Call that **Live debugging**!

## Taylor Otwell Laravel 5.3 Overview

**[Taylor Otwell](https://twitter.com/taylorotwell)** actually closed Day 1 talks with some pretty impressive announcements about new features coming to Laravel 5.3 and four major open source projects that will scale up the development time of any Laravel developer. I'll cover these new features a bit here.

### Laravel Scout

Laravel Scout is an optional drop-in package that offers full-text search for Eloquent Models. It ships with Algolia and offers a driver-based system so that anyone can actually integrate other full-text search systems. With Scout, after adding the `ScoutServiceProvider`, you'll be able to add a `Searchable` trait to your model and do something like so:

```php

Post::search('Prosper')->get(); // normal search
Post::search('Prosper')->paginate(20); // pagination option is also available
Post::search('Prosper')->where('category_id', 2)->get(); // inclusion of simple where clauses too

```

```php

Post::all()->searchable();
User::posts()->searchable();

```
### Laravel Passport

Laravel Passport literally blew my mind. Creating an OAuth2 Server can really be daunting. There are a few PHP packages out there that you can use, but they still involve a lot of work for the developer. Laravel Passport is an optional drop-in package that allows you to create an OAuth2 Server in about five minutes.  With Laravel Passport, you can get personal access tokens for users right from an Artisan command. It ships with Vue components for token generation, revocation, and a robust API authentication out of the box. You can easily set scopes by just enabling the scope middleware.

Want a single API for both mobile and internal web app calls? Laravel Passport will take care of it via [JWT](https://jwt.io) tokens.

<blockquote class="twitter-tweet" data-partner="tweetdeck"><p lang="en" dir="ltr">I&#39;ve been more excited this year about things coming out of <a href="https://twitter.com/LaraconUS">@LaraconUS</a> than of Apple&#39;s WWDC... Excellent work <a href="https://twitter.com/taylorotwell">@taylorotwell</a></p>&mdash; Martín Peverelli (@MartinPeverelli) <a href="https://twitter.com/MartinPeverelli/status/758459310267633664">July 28, 2016</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>

### Laravel Notifications

Laravel Notifications allow you to send quick updates to your users via services like SMS, email and Slack. In your Notification class, you have a `via` and `message` method like so:

```php
.....
public function via($notifiable)
{
    return ['mail', 'slack', 'sms']; // notification drivers
}

public function message()
{
    // If it's a notification success message, here you go
    $this->line('You can now use webtask.io for your serverless apps')
    ->action('Button Text', 'http://auth0.com')
    ->line('Please check it out!')
    ->success()

    // If it's a notification error message, here you go
    $this->line('We had a problem with your intro mail')
    ->action('Button Text', 'http://support.com')
    ->error()
}
```

Notifications also come with a responsive email template that detects email type (info, success, error) out of the box!

### Laravel Mailable

In Laravel 5.3, there's a less busy way to send emails. You can now send emails like so:

```php

// To one address
Mail::to($user)->send(new EmailClass($someParameter));

// To multiple addresses & queueing at the same time!
Mail::to('prosper@example.com')->cc('johndoe@example.com')->queue(new OrderComplete);
```

<blockquote class="twitter-tweet" data-partner="tweetdeck"><p lang="en" dir="ltr">Big fan of that new mail api. The closure way always felt a bit clunky <a href="https://twitter.com/hashtag/laracon?src=hash">#laracon</a></p>&mdash; Freek Van der Herten (@freekmurze) <a href="https://twitter.com/freekmurze/status/758405374143819776">July 27, 2016</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>

Other notable things Taylor mentioned are as follows:

* Single route file getting split into web.php and api.php in Laravel 5.3,
* Elixir 6.0 ships with Laravel 5.3. Supports rollup and webpack by default.
* Timeouts in queue worker will not make it frozen. Instead, it will *let it go* and keep processing the next
* Auth scaffolding moved from inline script/css with CDNs to a compiled js/css file
* Queueing greatly improved in Laravel 5.3
* Laravel 5.3 sets you up with boilerplate to work with Vue.js straight out of the box
* Laravel 5.3 packages will be able to register migrations to run with no work from the package user.

Want to learn how to build your first app using Laravel? Check out this [tutorial](https://auth0.com/blog/2016/06/23/creating-your-first-laravel-app-and-adding-authentication/).

<include src="TweetQuote" quoteText="This hopefully will make your life a lot easier - Taylor Otwell"/>

## Conclusion

Day 1 of Laracon US has been incredible. Laravel 5.3 will no doubt attract more PHP developers to use Laravel to build their next set of applications because of all these insane features and packages that Laravel and its community provides. Laravel 5.3 will be released a few weeks from now because Taylor wants the documentation to include all the improvements and new features.

 To conclude, I'll leave you with a list of additional resources and links to help you both learn Laravel and stay up to date with the latest news and announcements.

 * [Laravel news](https://laravel-news.com/) - Latest Laravel news, also maintains a live blog for Laracon
 * [Laracasts](https://laracasts.com/series/whats-new-in-laravel-5-3) - Learn everything about PHP and what's new in laravel 5.3
 * [Matt Stauffer's blog](https://mattstauffer.co/blog/series/new-features-in-laravel-5-3) - Learn about the latest Laravel 5.3 features


"laravel"