When redirecting the user to the OAuth page, we can overwrite the state parameter with anything we need: public function signInWithGoogle(Request $request) This is a special token which is checked against the current PHP session when extracting the returned user data (step 5) to protect against XSRF attacks. It turns out that Socialite also sends a special token as the state URI parameter to Google (step 2), which does get delivered to the destination (step 4). If that’s the case, then you should do the following… 2. The only case when you might not be able to use this approach is when you deal with a stateless backend such as an API, which implies that there is no session. The $secret variable now contains 123. $socialUser = Socialite::driver('google')->user() Public function callbackFromGoogle(Request $request) Return Socialite::driver('google')->redirect() This is the preferable solution and here’s how it looks: public function signInWithGoogle(Request $request) The title pretty much says it all: store any dynamic data you need in the Session object before redirecting to the external OAuth service (step2) and retrieve that data in the callback route that’s called upon the return. Solutionsįrom what I could gather so far, I know of two working solutions to this problem: 1. Google or Facebook), and not for your application. In fact these parameters can only be used as special values intended for the OAuth service itself (e.g.

Socialite does provide a way to pass optional parameters to the link that takes the user to the OAuth page (step 2), but unfortunately these parameters are not forwarded to your app’s destination URI on step 4. Just to make this clear from the start, the OAuth standard requires the redirect_uri to be registered with the OAuth provider (you probably know this already) so altering this value dinamically will not help, no matter how we do it. Altering redirect_uri (violates the OAuth rules) To save you some time, I’ll mention some ideas here which are not possible solutions. You might want to do this, for example, when you have multiple points of login, and you need to know (at the destination) where the user came from. Overall, this works very well, except when you need to pass some custom data to the destination URI on-the-fly. Note: On step 2, when jumping to Google, Socialite appends a special query parameter called redirect_uri, which is your app’s URI where Google will redirect the user at step 4. AuthController::callbackFromGoogle() įinally your app extracts the user’s data (returned by Google) using Socialite::driver('google')->user() and proceeds to authenticate current session (btw, the user is created if new). Then, Google redirects the user back to your application’s callback route, e.g. Your app redirects using Socialite::driver('google')->redirect() which redirects the user to Google’s authentication page The user clicks “Sign in with Google” which calls a method in your app’s authentication controller, for example AuthController::signInWithGoogle()

Just as a brief clarification, the Socialite/OAuth flow implies the following steps (note that I’m using Google here as an example, but it can be any OAuth service provider): Passing dynamic data to the external OAuth system and getting that data back to your application, using Socialite, is something neither easily done nor well documented and given that I’ve seen a lot of people wasting time on this, I want to try and shed some light on it here. * The accessors to append to the model's array form.If you’ve ever done authentication in a Laravel-based project then you probably had to deal with the Socialite extension, which enables OAuth-based authentication using third-party services (like Google or Facebook). Resources/views/auth/ (session('status')) Return redirect()->intended('dashboard') $finduser = User::where('facebook_id', $user->id)->first() $user = Socialite::driver('facebook')->user() And we have added a redirect() function to redirect the user to Facebook and the callback() function is used to handle the user when callback from Facebook.Īpp/Http/Controllers/LoginWithFacebookController.php redirect() Now, create a LoginWithFacebookController.

Laravel socialite vs