Laravel - authenticating with session token

laravel, session, token

Solution

You may have a table for saving tokens

Add a filter in routes.php

Route::group(array('before' => 'auth'), function() { ... })

And in the filters.php you can search the token in the database, if isn't exist you return a no access response

Route::filter('auth', function () {

$input_token = Input::get('token');

if (!empty($input_token)) {
    $validator = Validator::make(
        ['token' => $input_token],
        ['token' => 'token']
    );
    if (!$validator->fails()) {

        $token = Token::where('hash', $input_token)->first();

        if ($token) {

            $user = User::find($token->user_id);

            if ($user) {

                Auth::login($user);
                return;

            }
        }
    }
}

$response = Response::make(json_encode([
    'error' => true,
    'messages' => [
        Lang::get('errors.NO_ACCESS')
    ]
]), 200);

$response->header('Content-Type', 'application/json');

return $response;
});

Problem

Upon login, I return the user object + session token in JSON form, so that the mobile device that connects to my application can be authenticated. However, I have a difficulty understanding how would I go about authenticating the user only with his session id? Once logged in, the mobile device sends the session token upon every request, which means I somehow need to check whether it's the same user (using a custom auth filter). How would I do it?

Original source