Laravel 11：如何使用Cookie手动认证跨域请求？

1. 创建认证中间件 #

首先生成自定义中间件：

php artisan make:middleware AuthenticateBearerCookie

2. 编写中间件认证逻辑 #

打开生成的app/Http/Middleware/AuthenticateBearerCookie.php，替换handle方法。根据你前端存储的Cookie值类型，选择对应场景：

场景一：Bearer Token是Laravel Session ID

如果前端存在sessionStorage的是Laravel默认的laravel_session值，通过session ID找回用户会话：

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Session;

class AuthenticateBearerCookie
{
    public function handle(Request $request, Closure $next)
    {
        // 从请求头获取Bearer Token
        $sessionId = $request->bearerToken();

        if (!$sessionId) {
            return response()->json(['message' => '未提供有效认证信息'], 401);
        }

        // 读取会话存储中的数据
        $sessionContent = Session::getHandler()->read($sessionId);
        if (empty($sessionContent)) {
            return response()->json(['message' => '无效的会话凭证'], 401);
        }

        // 反序列化会话数据，提取登录用户ID
        $sessionData = unserialize($sessionContent);
        $recallerKey = auth()->getRecallerName(); // 获取Laravel默认登录会话键
        $userId = $sessionData[$recallerKey] ?? null;

        if (!$userId) {
            return response()->json(['message' => '未找到关联用户'], 401);
        }

        // 查找用户并完成登录
        $user = \App\Models\User::find($userId);
        if (!$user) {
            return response()->json(['message' => '用户不存在'], 401);
        }

        auth()->login($user);

        return $next($request);
    }
}

场景二：Bearer Token是自定义用户Token

如果前端存储的是用户表中自定义的api_token字段值，直接通过Token匹配用户：

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;

class AuthenticateBearerCookie
{
    public function handle(Request $request, Closure $next)
    {
        $token = $request->bearerToken();

        if (!$token) {
            return response()->json(['message' => '未提供有效认证信息'], 401);
        }

        // 通过自定义Token查找用户
        $user = \App\Models\User::where('api_token', $token)->first();
        if (!$user) {
            return response()->json(['message' => '认证失败'], 401);
        }

        auth()->login($user);

        return $next($request);
    }
}

3. 注册中间件 #

Laravel 11中，在bootstrap/app.php里将中间件绑定到目标路由组（比如API路由组）：

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        web: __DIR__.'/../routes/web.php',
        api: __DIR__.'/../routes/api.php',
        commands: __DIR__.'/../routes/console.php',
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware) {
        // 将中间件添加到API路由组
        $middleware->api(append: [
            \App\Http\Middleware\AuthenticateBearerCookie::class,
        ]);
    })
    ->create();

4. 跨域配置检查 #

确保config/cors.php中允许Authorization请求头，并配置正确的前端域名：

return [
    'paths' => ['api/*'],
    'allowed_methods' => ['*'],
    'allowed_origins' => ['https://your-frontend-domain.com'], // 替换为你的前端域名
    'allowed_origins_patterns' => [],
    'allowed_headers' => ['Content-Type', 'Authorization'], // 必须包含Authorization
    'exposed_headers' => [],
    'max_age' => 0,
    'supports_credentials' => false, // 无需开启，因为用Bearer Token而非Cookie
];

内容的提问来源于stack exchange，提问作者naoru