Executive Summary: Token management, token refresh mechanisms, rate limiting, and RBAC permissions for public and mobile client APIs.
Securing API endpoints against unauthorized access, replay attacks, and credential stuffing requires robust token management and authorization middleware.
Stateful Cookie Sessions (Laravel Sanctum SPA): Uses HTTP-only, secure, SameSite cookies for single-page web applications. Prevents XSS script token theft.
Stateless Bearer Tokens (Mobile & Third-Party APIs): Uses hashed Personal Access Tokens (PATs) passed in the Authorization: Bearer <token> header.
Enforce granular token permissions (abilities / scopes) so that API keys issued to third-party integrations only possess the precise privileges required (e.g. orders:create without users:delete).
Protect endpoints against brute-force attacks by configuring IP-based and user-based rate limiters (throttle:60,1) using Redis backends.
1. Stateful vs Stateless API Authentication
2. Role-Based Access Control (RBAC) & Scopes
Enforce granular token permissions (abilities / scopes) so that API keys issued to third-party integrations only possess the precise privileges required (e.g. orders:create without users:delete).
3. Rate Limiting & Throttling
Protect endpoints against brute-force attacks by configuring IP-based and user-based rate limiters (throttle:60,1) using Redis backends.