laravel:api-authentication

Api Authentication (Laravel)

Use when

• Hardening authentication/authorization/validation paths.
• Standardizing access control and error semantics.

Default workflow

1. Map actors, protected resources, and allowed actions.
2. Implement validation + authorization at explicit boundaries.
3. Apply throttling and consistent failure responses.
4. Test authorized/unauthorized/invalid scenarios.

Guardrails

• Do not leak sensitive existence or permission details.
• Never rely on UI-only access checks.
• Keep auth and validation logic centralized.

Progressive disclosure

• Start with this file for execution posture and constraints.
• Load references only for deep implementation detail or edge cases.

Output contract

• Security boundary changes and rationale.
• Endpoints/middleware/policies updated.
• Negative-path test evidence.

References

• reference.md
• docs/complexity-tiers.md