Laravel API购物车PUT请求返回401未授权问题排查求助

测试Laravel API时，调用购物车PUT接口（/cart/{cartId}）每次都返回401未授权错误。已核对用户表中的凭证，确认与注册、登录时输入一致，求检查代码是否遗漏关键内容。

登录控制器代码 #

public function login(Request $request)
{
    $validator = validator($request->all(), [
        "name" => "required",
        "password" => "required",
    ]);

    if ($validator->fails()) {
        return $this->BadRequest($validator, "all fields are required");
    }

    $validated = $validator->validated();

    if (!auth()->attempt([
            filter_var($validated["name"], FILTER_VALIDATE_EMAIL) ? "email" : "name" => $validated["name"],
            "password" => $validated["password"]
        ])){
        return $this->Unauthorized();
    }

    $user = auth()->user();
    $user->profile;

    return $this->ok([$user,]"Logged in succesfully");
    
}

路由配置代码 #

Route::middleware("auth:api")->get("/checktoken", [AuthController::class, "checktoken"])->middleware("auth:api");
Route::post("/register", [AuthController::class, "register"]);
Route::post("/login", [AuthController::class, "login"]);
Route::post("/status", [OrderController::class, "status"])->middleware("auth:api");

Route::middleware('auth:api')->group(function () {
Route::get('/cart', [CartController::class, 'index']);
Route::post('/cart', [CartController::class, 'add']);
Route::put('/cart/{cartId}', [CartController::class, 'update']);
Route::delete('/cart/{cartId}', [CartController::class, 'remove']);
Route::post('/cart/checkout', [CartController::class, 'checkout']);

注册控制器代码 #

public function register(Request $request)
{
    $validator = validator($request->all(), [
        "name" => "required|min:4|max:32|alpha_dash|string|unique:users",
        "email" => "required|email|max:255",
        "password" => "required|min:8|max:64|string|confirmed",
        "first_name" => "required|string|max:64|min:1|string",
        "last_name" => "required|string|max:64|min:1|string"
    ]);

    if ($validator->fails()) {
        return $this->BadRequest($validator);
    }
    //this creates the user login information in the users table
    $user = User::create($validator->safe()->only("name", "email", "password"));
    $user->profile()->create($validator->safe()->except("name", "email", "password"));

    return response()->json([$user, "account was succesfully created! " ], 201);
}

排查关键点 #

• API令牌缺失：登录接口仅返回用户对象，未生成并返回API认证令牌（如Sanctum/Passport令牌）。前端请求购物车接口时无法携带有效凭证，导致401。需在登录成功后添加令牌生成逻辑，示例：

  $token = $user->createToken('api-token')->plainTextToken;
  return $this->ok(['user' => $user, 'token' => $token], "Logged in successfully");
  

• 密码未加密存储：注册时直接存入明文密码，若User模型未自动加密密码，会导致auth()->attempt验证逻辑异常（即使登录返回成功，实际令牌可能无效）。需确保User模型中password字段被Laravel自动哈希处理，或手动在创建用户时加密：

  $user = User::create([
      'name' => $validator->safe()->get('name'),
      'email' => $validator->safe()->get('email'),
      'password' => Hash::make($validator->safe()->get('password')),
  ]);
  

• 路由语法错误：路由组未闭合（缺少});），可能导致中间件未正确绑定到购物车路由，引发认证逻辑失效。需补全路由组闭合标签。
• 认证守卫配置：检查config/auth.php中guards.api的驱动是否与项目使用的认证方式匹配（如sanctum），避免中间件使用错误的认证逻辑。
• 请求头格式错误：前端请求时需确保Authorization头格式为Bearer {token}，令牌无拼写错误、未过期。

内容的提问来源于stack exchange，提问作者solo1