Laravel Authentication: Breeze, Jetstream, Fortify & Manual Auth

Authentication (verifying who a user is) is the backbone of almost every modern web application. Laravel provides the most versatile authentication tooling in the industry: you can scaffold a complete, production-ready login/registration system in 30 seconds using Laravel Breeze, build a SaaS portal with 2FA using Jetstream, or write clean manual authentication logic using the Auth facade.

1. Scaffolding Authentication with Laravel Breeze

Installing Breeze takes just three simple terminal commands:

# 1. Require Breeze package as dev dependency
composer require laravel/breeze --dev

# 2. Install Breeze with Blade & Tailwind stack
php artisan breeze:install blade

# 3. Migrate auth database tables (users, password_reset_tokens)
php artisan migrate

# 4. Compile frontend assets
npm install && npm run dev

Instantly, your application possesses fully functional, beautifully styled pages for /login, /register, /forgot-password, /reset-password, and a secure /dashboard protected by authentication middleware!

2. Manual Authentication with the Auth Facade

If you prefer to write your own custom login controller without starter kits, use the Auth::attempt() method:

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;

class LoginController extends Controller
{
    public function authenticate(Request $request)
    {
        $credentials = $request->validate([
            'email'    => ['required', 'email'],
            'password' => ['required'],
        ]);

        // "Remember Me" checkbox boolean
        $remember = $request->boolean('remember');

        // Auth::attempt automatically verifies the bcrypt/Argon2 password hash
        if (Auth::attempt($credentials, $remember)) {
            // Regenerate session to prevent session fixation attacks
            $request->session()->regenerate();

            // Redirect to intended protected page or default dashboard
            return redirect()->intended('dashboard');
        }

        // Authentication failed
        return back()->withErrors([
            'email' => 'The provided credentials do not match our records.',
        ])->onlyInput('email');
    }

    public function logout(Request $request)
    {
        Auth::logout();
        $request->session()->invalidate();
        $request->session()->regenerateToken();

        return redirect('/');
    }
}

3. Understanding Guards and Providers

In config/auth.php, Laravel decouples authentication into two components:

• Guards: Define how users are authenticated on each request (e.g. web guard uses session cookies; sanctum guard uses API Bearer tokens).
• User Providers: Define where user credentials are retrieved from (e.g. the eloquent provider queries your App\Models\User model in MySQL).