D
Engineering

Auth & JWT

Three parallel auth mechanisms. JWT issued by dazoapp is a cross-service credential — not internal auth.

Three guards run in parallel: web (session), api (JWT), and Sanctum.

Key points (see Indonesian version for details):

  • Token issuance: AuthService.php:159/:188, QuickLoginController.php:58, WelcomeController.php:614
  • Refresh endpoint: POST /api/refresh (routes/api.php:85)
  • services/axiosInstance.js handles 401 with single-flight refresh + request queue
  • Two login-as-user routes use random path strings as the only protection (security by obscurity)
  • Do not change JWT_SECRET, JWT_TTL, payload, or refresh endpoint without cross-repo coordination