laravel Auth::login($user) always return 401 Unauthorized

Question

I'm a newbie in laravel. I work with a simple blog with angular and laravel. I use Sanctum for authorization and registration. This is my code AuthController:

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use App\Http\Controllers\Controller;
use Illuminate\Support\Facades\Hash;
use Auth;
use Validator;
use App\Models\User;

class AuthController extends Controller
{
    
     public function register(Request $request)
    {
        $validator = Validator::make($request->all(),[
            'name' => 'required|string|max:255|unique:users',
            'email' => 'required|string|email|max:255|unique:users',
            'password' => 'required|string|min:8'
        ]);

        if($validator->fails()){
            return response()->json($validator->errors());       
        }

        $user = User::create([
            'name' => $request->name,
            'email' => $request->email,
            'password' => Hash::make($request->password)
         ]);

        $token = $user->createToken('auth_token')->plainTextToken;
        

       Auth::login($user);
       
            return response()
            ->json(['result' => 'success']);
    }

    public function login(Request $request)
    {
        if (!Auth::attempt($request->only('name', 'password')))
        {
            return response()
                ->json(['message' => 'Unauthorized']);
        }

        $user = User::where('name', $request['name'])->firstOrFail();

        $token = $user->createToken('auth_token')->plainTextToken;

        return response()
            ->json(['message' => 'Authorized']);
    }

    // method for user logout and delete token
    public function logout()
    {
        auth()->user()->tokens()->delete();

        return response()->json([
            'message' => 'You have successfully logged out and the token was successfully deleted'
        ]);
    }
    
}

web.php

<?php

use Illuminate\Support\Facades\Route;

use App\Http\Controllers\MainController;
use App\Http\Controllers\StoryController;
use App\Http\Controllers\AuthController;
/*
|--------------------------------------------------------------------------
| Web Routes
|--------------------------------------------------------------------------
|
| Here is where you can register web routes for your application. These
| routes are loaded by the RouteServiceProvider within a group which
| contains the "web" middleware group. Now create something great!
|
*/

Route::get('/', [MainController::class, 'home']);

Route::get('/about', [MainController::class,'about']);

Route::get('/review', [MainController::class,'review'])->name('review');
Route::post('/review/check', [MainController::class,'review_check']);



/*Route::get('/about/{id}/{name}', function ($id,$name) {
    return "ID:".$id." Name:".$name;
});*/

Auth::routes();

Route::get('/home', [App\Http\Controllers\HomeController::class, 'index'])->name('home');

//Route::post('/api/saveStory', [StoryController::class,'store']);

Route::apiResource('api/saveStory', 'StoryController');

//Route::resource('/api/story', 'StoryController');

Route::post('api/register', [AuthController::class, 'register']);
//API route for login user
Route::post('api/login', [AuthController::class, 'login']);

//Protecting Routes
Route::group(['middleware' => ['auth:sanctum']], function () {
    Route::post('api/user-information', function(Request $request) {
        return auth()->user();
    });

    // API route for logout user
    Route::post('api/logout', [AuthController::class, 'logout']);
});

This work fine. But when i'm success login and send post request angular to 'api/user-information' i always get error '401 Unauthorized'. angular 2 request:

loginMethod()
  {
      this.http.post(this.baseUrl+"api/login", this.loginForm).subscribe( 
      (data:ResponseLogin)=>{
          this.responseLogin=data;
          if(this.responseLogin.message ==='Authorized') 
          {
               this.router.navigate(['/user-profile']);
          }
          console.log("this.responseLogin.message:"+this.responseLogin.message);
         
      },
       error => console.log(error)
      );
  }

Route::group(['middleware' => ['auth:sanctum']], function () {
    Route::post('api/user-information', function(Request $request) {
        return auth()->user();
    });

But when I send request 'api/user-information' using Postman, I'm success get data authorized user. Please help me resolve this problem.

Answer 1

First, you have to send your authorization token too with your request. You are sending request to protected endpoint. Laravel has middleware to check if the user authenticated or not. If you try to send a request to /about it shouldn't be a problem but you are sending request to route that has protected with middleware.