Laravel中JWT认证后无法通过Auth::user()获取用户数据求助

核心原因 #

Laravel默认的auth中间件基于Session认证体系，而你使用的JWT属于Token认证，两者驱动不匹配，导致Auth::user()无法正确读取认证用户信息。

解决步骤 #

1. 替换路由中间件 #

将路由组中的auth中间件改为auth:api，明确指定使用JWT驱动的API Guard：

Route::group(['middleware' => 'auth:api'], function () {
    Route::post('auth/update/professional', 'App\Http\Controllers\Api\UpdateController@updateToProfessional');
    Route::post('auth/update/user', 'App\Http\Controllers\Api\UpdateController@updateToUser');
    Route::post('auth/edit/data', 'App\Http\Controllers\Api\Auth\EditDataController@updateName');
    Route::post('auth/edit/phone/number', 'App\Http\Controllers\Api\Auth\EditDataController@updatePhoneNumber');
    Route::post('auth/edit/password', 'App\Http\Controllers\Api\Auth\EditDataController@updatePassword');
    Route::post('auth/forget/password', 'App\Http\Controllers\Api\Auth\ForgotPasswordController@submitForgetPasswordForm');
    Route::post('auth/reset/password', 'App\Http\Controllers\Api\Auth\ForgotPasswordController@submitResetPasswordForm');
    Route::post('create/order', 'App\Http\Controllers\Api\CustomerOrderController@create');
    Route::post('update/order', 'App\Http\Controllers\Api\CustomerOrderController@update');
    Route::post('delete/order', 'App\Http\Controllers\Api\CustomerOrderController@delete');
});

2. 确认Auth配置的Guard驱动 #

打开config/auth.php，检查guards配置，确保API Guard使用JWT驱动：

'guards' => [
    'web' => [
        'driver' => 'session',
        'provider' => 'users',
    ],
    'api' => [
        'driver' => 'jwt', // 此处必须设置为jwt
        'provider' => 'users',
    ],
],

3. 优化控制器用户获取逻辑 #

无需通过User::find(Auth::user()->id)二次查询，直接使用Auth::user()获取当前用户，同时增加空值判断避免报错：

class UpdateController extends Controller
{
    public function __construct()
    {
        $this->middleware('auth:api'); // 同步修改控制器中间件为auth:api
    }

    public function updateToProfessional(Request $request)
    {
        $request->validate([
            'services' => ['required', 'string', 'max:255','exists:services'],
        ]);

        $user = Auth::user();
        if (!$user) {
            return response()->json(['error' => '用户未认证'], 401);
        }

        $user->removeRole('Regular User');
        $user->assignRole('Professional');

        return $user;
    }
}

4. 忽略laravel/ui安装提示 #

系统提示安装laravel/ui是因为默认auth::routes()依赖该包，但你已通过JWT自行实现认证路由，此提示可直接忽略，只需确保请求Header中携带正确的Authorization: Bearer {你的JWT Token}即可。

内容的提问来源于stack exchange，提问作者4ri37ix L