GUIDES
A CORS misconfiguration only ever breaks browser-based cross-origin requests — a tool like Postman or a server-to-server call is entirely unaffected, since CORS is a browser-enforced restriction, not a server-side one.
The most widely used role/permission package for Laravel — assigning roles, checking permissions in code and Blade, and the middleware that gates routes by role.
Rendering multiple locations from a database onto one map, each with its own clickable info window, is a matter of looping your data into the Maps JavaScript API's marker and InfoWindow objects.
Laravel Socialite handles both Google and Facebook login with the same driver-based API — sharing a page out to social media, by contrast, needs no package at all.
A migration is a version-controlled, reversible description of one schema change — the file, the up()/down() methods, and the commands that actually apply or undo it.
Remember-me works through a separate long-lived cookie and token column, entirely independent of the normal session — this is exactly why closing the browser doesn't log the user out even after the session itself would have expired.
Eloquent's array and json casts handle the encoding and decoding transparently — a model attribute reads and writes as a real PHP array, with the JSON conversion happening invisibly underneath.
An interface exists only at compile time and vanishes entirely from the compiled JavaScript — it shapes what TypeScript checks, but it can never carry actual runtime behavior the way a class can.
Passwordless auth trades a stored password hash for a short-lived, single-use numeric code sent by email or SMS — the same pattern whether the endpoint is a traditional web form or a JSON API.
inRandomOrder() and lastInsertId() solve two small, specific problems that come up often enough to be worth knowing by name rather than working out from scratch each time.
Cookie::queue() versus attaching a cookie directly to a response, why cookies are encrypted by default, and the correct way to actually delete one.
Beyond the input fields you validate, the Request object exposes headers, raw JSON, the client's IP, and the current domain — all through the same object already injected into your controller methods.
