TOPIC
Middleware runs between a request arriving and a controller handling it — the mechanism behind auth checks, CORS headers, and rate limiting, all inspecting or modifying the request/response without the controller knowing.
Beyond auth (which uses sessions internally), the Session facade is the standard place for anything that needs to persist briefly across requests for one visitor — flash messages, a multi-step form's in-progress data, a shopping cart.
The confirmed rule has one specific, easy-to-miss requirement: the confirmation field must be named exactly {field}_confirmation, or the rule silently never matches anything.
Laravel's "remember me" is a single boolean argument to Auth::attempt — the useful part to actually understand is the long-lived cookie and remember_token column behind it.
Laravel Socialite handles the OAuth handshake for Google, Facebook, and several other providers behind one consistent API — the redirect, the callback, and mapping the returned profile onto a local user.
A minimal OTP login flow built on top of Laravel's own auth system — generate a code, email or text it, verify it, then log the user in — without reaching for a full package if you don't need one.
The most widely used role/permission package for Laravel — assigning roles, checking permissions in code and Blade, and the middleware that gates routes by role.
Setting up tymon/jwt-auth for a stateless API, and why JWT is the wrong choice for a normal server-rendered app with sessions.
PDO is the modern, framework-agnostic way to talk to MySQL from plain PHP — and prepared statements aren't optional if user input touches the query.
The Hash facade, why bcrypt/argon2 hashes look different every time for the same password, and the correct way to verify a login without ever decrypting anything.
The Crypt facade, AES-256-CBC under the hood, and why encrypted values are not the right tool for anything you need to search or index in the database.
Laravel 11 removed app/Http/Kernel.php — here is how middleware registration actually works now, with a working example.
