Prueba Soporte uses Laravel Breeze for session-based authentication. All task routes — and the dashboard — are protected by the auth middleware, meaning users must be logged in before they can view or manage tasks.
Route protection
The task and profile routes are wrapped in an auth middleware group in routes/web.php:
Route::middleware('auth')->group(function () {
Route::get('/profile', [ProfileController::class, 'edit'])->name('profile.edit');
Route::patch('/profile', [ProfileController::class, 'update'])->name('profile.update');
Route::delete('/profile', [ProfileController::class, 'destroy'])->name('profile.destroy');
Route::get('/tasks/index', [TaskController::class, 'index'])->name('task.index');
Route::post('/tasks', [TaskController::class, 'store']);
Route::put('/tasks/{id}/complete', [TaskController::class, 'update']);
Route::delete('/tasks/{id}', [TaskController::class, 'destroy']);
Route::get('/tasks', function () {
return view('tasks');
})->name('tasks');
});
verified middleware:
Route::get('/dashboard', function () {
return Inertia::render('Dashboard');
})->middleware(['auth', 'verified'])->name('dashboard');
Unauthenticated requests to any of the above routes are automatically redirected to /login by Laravel’s authentication middleware.
Session-based auth flow
Authentication is entirely session-based. On a successful login, Laravel creates a server-side session and issues a session cookie to the browser. Every subsequent request carries that cookie, and Laravel resolves the authenticated user from the session store without requiring tokens or additional headers.
Login workflow
Visit the login page
The root URL / renders the Auth:Login Inertia view. The guest middleware group in routes/auth.php also exposes the login form directly at /login:Route::get('login', [AuthenticatedSessionController::class, 'create'])
->name('login');
Submit credentials
The form POSTs to /login, handled by AuthenticatedSessionController@store. Laravel validates the credentials against the users table (email + hashed password).Route::post('login', [AuthenticatedSessionController::class, 'store']);
Session is created
On success, a new session is started, the user is marked as authenticated, and the browser receives a session cookie. The user is redirected to their intended destination (or /tasks/index by default — the task.index named route as configured in AuthenticatedSessionController).
Access protected routes
With a valid session cookie, the user can access all routes inside the auth middleware group — including /tasks and all task API endpoints.
Registration workflow
New accounts are created through /register, which is also behind the guest middleware so already-authenticated users cannot access it:
Route::get('register', [RegisteredUserController::class, 'create'])
->name('register');
Route::post('register', [RegisteredUserController::class, 'store']);
The User model marks email_verified_at as a datetime cast, so email verification is supported. The dashboard route enforces verification via the verified middleware — users who have not verified their email will be redirected to the verification notice page.
Password reset
Full password reset is available via the following routes, all behind the guest middleware:
// Request a reset link
Route::get('forgot-password', [PasswordResetLinkController::class, 'create'])
->name('password.request');
Route::post('forgot-password', [PasswordResetLinkController::class, 'store'])
->name('password.email');
// Set a new password using the token from the email
Route::get('reset-password/{token}', [NewPasswordController::class, 'create'])
->name('password.reset');
Route::post('reset-password', [NewPasswordController::class, 'store'])
->name('password.store');
Email verification
For authenticated users who have not yet verified their email, the following routes are available:
Route::get('verify-email', EmailVerificationPromptController::class)
->name('verification.notice');
Route::get('verify-email/{id}/{hash}', VerifyEmailController::class)
->middleware(['signed', 'throttle:6,1'])
->name('verification.verify');
Route::post('email/verification-notification', [EmailVerificationNotificationController::class, 'store'])
->middleware('throttle:6,1')
->name('verification.send');
Password confirmation
Sensitive operations can require the user to re-enter their current password before proceeding:
Route::get('confirm-password', [ConfirmablePasswordController::class, 'show'])
->name('password.confirm');
Route::post('confirm-password', [ConfirmablePasswordController::class, 'store']);
Profile management
Authenticated users can manage their account through three profile endpoints:
| Method | Route | Action |
|---|
GET | /profile | Show the profile edit form |
PATCH | /profile | Update name, email, or password |
DELETE | /profile | Permanently delete the account |
Route::get('/profile', [ProfileController::class, 'edit'])->name('profile.edit');
Route::patch('/profile', [ProfileController::class, 'update'])->name('profile.update');
Route::delete('/profile', [ProfileController::class, 'destroy'])->name('profile.destroy');
Route::put('password', [PasswordController::class, 'update'])->name('password.update');
Logout
Logging out destroys the current session and invalidates the session cookie:
Route::post('logout', [AuthenticatedSessionController::class, 'destroy'])
->name('logout');
Logout uses a POST request (not GET) to protect against cross-site request forgery. Breeze includes the required CSRF token automatically in all forms.
