title: Laravel 5.6 - Passport JWT httponly cookie SPA authentication for self consuming API?
body: <p><strong>NOTE: I had 4 bounties on this question, but non of the upvoted answers below are the answer needed for this question. Everything needed is in Update 3 below, just looking for Laravel code to implement.</strong></p>
  
  <hr>
  
  <p><strong>UPDATE 3: This flow chart is <em>exactly</em> the flow I am trying to accomplish, everything below is the original question with some older updates. This flow chart sums up everything needed.</strong></p>
  
  <p>The green parts in the flow chart below are the parts that I know how to do. The red parts along with their side notes is what I am looking for help accomplishing using Laravel code.</p>
  
  <p><a href="https://i.stack.imgur.com/6aIzj.jpg" rel="noreferrer"><img src="https://i.stack.imgur.com/6aIzj.jpg" alt="enter image description here"></a></p>
  
  <hr>
  
  <p>I have done a lot of research but the information always ended up short and not complete when it comes to using Laravel with a JWT httponly cookie for a self consuming API (most tutorials online only show JWT being stored in local storage which is not very secure). It looks like httponly cookie containing a JWT by Passport should be used to identify the user on the Javascript side when sent with every request to the server to validate that the user is who they say they are.</p>
  
  <p>There are also some additional things that are needed to have a complete picture of how to make this setup work which I haven't come across in a single tutorial which covers this:</p>
  
  <ol>
  <li>Laravel Passport (not tymon auth) to generate encrypted JWT and send it as httponly cookie as response after login from JS side. What middleware to use? If refresh tokens add more security, how to implement?</li>
  <li>JavaScript (axios for example) api pseudo code that makes call to auth endpoint, how is httponly cookie passed to backend, and how does backend verify token is valid.</li>
  <li>If single account is logged in from multiple devices, then a device is stolen, how to revoke access from all the authed user devices (assuming user does Change Password from a logged in device they have control over)?</li>
  <li>What would Login/Register, Logout, Change Password, Forgot Password controller methods typically look like to handle the creation/validating/revoking of tokens?</li>
  <li>CSRF token integration.</li>
  </ol>
  
  <p>I hope an answer to this question serves as an easy to follow guide for future readers and those struggling at the moment to find an answer covering the above points on a self consuming API.</p>
  
  <p><strong>UPDATE 1:</strong></p>
  
  <ol>
  <li>Please note I tried the <code>CreateFreshApiToken</code> before, but that didn't work when it comes to revoking tokens of the user (for points 3 and 4 above). This is based on <a href="https://github.com/laravel/passport/issues/507#issuecomment-430997606" rel="noreferrer">this comment</a> by a core laravel developer, when talking about the <code>CreateFreshApiToken</code> middleware:</li>
  </ol>
  
  <blockquote>
    <p>JWT tokens created by this middleware aren't stored anywhere. They
    can't be revoked or "not exist". They simply provide a way for your
    api calls to be authed through the laravel_token cookie. It isn't
    related to access tokens.
        Also: you normally wouldn't use tokens issued by clients on the same app which issues them. You'd use them in a first or third party
    app. Either use the middleware or the client issued tokens but not
    both at the same time.</p>
  </blockquote>
  
  <p>So it seems to be able to cater to points 3 and 4 to revoke tokens, it's not possible to do so if using the <code>CreateFreshApiToken</code> middleware.</p>
  
  <ol start="2">
  <li>On the client side, it seems <code>Authorization: Bearer &lt;token&gt;</code> is not the way to go when dealing with the secure httpOnly cookie. I think the request/response are supposed to include the secure httpOnly cookie as a request/response header, like this based on the laravel docs:</li>
  </ol>
  
  <blockquote>
    <p>When using this method of authentication, the default Laravel
    JavaScript scaffolding instructs Axios to always send the X-CSRF-TOKEN
    and X-Requested-With headers.</p>
  </blockquote>
  
  <pre><code>headerswindow.axios.defaults.headers.common = {
      'X-Requested-With': 'XMLHttpRequest',
      'X-CSRF-TOKEN': (csrf_token goes here)
  };
  </code></pre>
  
  <p>This is also the reason I am looking for a solution which covers all the points above. Apologies, I am using Laravel 5.6 not 5.5.</p>
  
  <p><strong>UPDATE 2:</strong></p>
  
  <p>It seems the <strong>Password Grant/Refresh Token Grant</strong> combo is the way to go. Looking for an easy to follow implementation guide using <strong>Password Grant/Refresh Token Grant</strong> combo.</p>
  
  <blockquote>
    <p><strong>Password Grant:</strong>
    This grant is suitable when dealing with the client that we trust,
    like a mobile app for our own website. In this case, the client sends
    the user's login credentials to the authorization server and the
    server directly issues the access token.</p>
    
    <p><strong>Refresh Token Grant:</strong>
    When the server issues an access token, it also sets an expiry for the
    access token. Refresh token grant is used when we want to refresh the
    access token once it is expired. In this case, authorization server
    will send a refresh token while issuing the access token, which can be
    used to request a new access token.</p>
  </blockquote>
  
  <p>I am looking for an easy to implement, straight forward, holistic answer using the <strong>Password Grant/Refresh Token Grant</strong> combo that covers all the parts of the above original 5 points with httpOnly secure cookie, creating/revoking/refreshing tokens, login cookie creation, logout cookie revoking, controller methods, CSRF, etc.</p>