How does Laravel handle authentication and authorization by default?

Laravel provides a Defense-in-Depth security system, separating Authentication (who the user is) from Authorization (what the user can do). Its modern architecture supports headless apps, MFA-first designs, and flexible SaaS-ready solutions.

1. The Authentication Engine

Laravel’s authentication relies on two core concepts: Guards and Providers.

• Guards: Define how users are authenticated per request.
  • web guard: Session and cookie-based (browser apps)
  • api guard: Token-based, typically using Sanctum for SPAs or mobile, or Passport for OAuth2 APIs
• Providers: Define how users are retrieved from storage.
  • Eloquent: Default provider, using the User model to validate credentials.

First-Party Starter Kits

• Laravel Breeze: Modern lightweight starter kit. Now includes TypeScript, Tailwind CSS v4, and Shadcn/ui. Ideal for React, Vue, or Livewire apps with AI-assisted scaffolding.
• Laravel Jetstream: Enterprise/SaaS scaffolding. Supports Passkeys/WebAuthn, 2FA, team management, session tracking, billing, and deep Filament integration.
• Laravel Fortify: Headless backend engine for login, registration, password reset, and 2FA. Perfect for custom frontends (React, Vue, or mobile).

2. The Authorization Layer

After authentication, Laravel manages authorization via Gates and Policies:

Pro Tip: Use Policy Auto-Discovery. Laravel 12 automatically links PostPolicy in app/Policies to the Post model.

3. Default Security Features

• CSRF Protection: All POST requests include a token to prevent cross-site request forgery.
• Password Hashing: Argon2 or Bcrypt by default; no plain-text passwords are stored.
• Session Security: Encrypted sessions with HttpOnly cookies prevent XSS-based hijacking.
• Rate Limiting: Automatically protects login routes from brute-force attacks.
• MFA/2FA: Fully supported via Jetstream or Fortify, including WebAuthn/Passkeys.
• SPA/Mobile Support: Sanctum provides stateful cookie authentication, safer than local storage tokens.
• OAuth2 API Access: Passport supports enterprise B2B or multi-tenant API applications.

4. Implementation Checklist

• Protect routes with middleware: ->middleware(['auth'])
• Always use Gates/Policies: avoid inline checks like auth()->user()->id === $post->user_id
• Use Sanctum for SPAs/mobile for secure token management
• Implement Policy Auto-Discovery for model-specific permissions
• Enable MFA/2FA for admins and optional for users
• Log authentication attempts and failures for auditing

Conclusion: Laravel 12 provides a secure, modular, and flexible authentication and authorization system. Fortify serves as the backend foundation, Breeze and Jetstream provide frontend scaffolding, and Sanctum/Passport enable modern SPA and API-first architectures. Developers can implement MFA-first, headless-ready authentication effortlessly.