Can't get Auth object and cookies by consuming my own Laravel API

I'm currently trying to build a secure SPA application in Laravel by using :

• Laravel 5.6
• Laravel Passport
• Guzzle client

To make the whole application secure, I created a proxy to prefix all requests to the API and :

• User the password grand type of token
• Hide the client ID
• Hide the client secret
• Add automatic scopes based on the role of the user

This is how the Proxy works :

// The proxify endpoint for all API requests
Route::group(['middleware' => ['web']], function () 
{
    Route::any('proxify/{url?}', function(Request $request, $url) {
        return Proxify::makeRequest($request->method(), $request->all(), $url);
    })->where('url', '(.*)');
});

Each time a request is made, it goes through that package I built to create the access token, refreshing it, or deleting it.

To create the access token for the user I'm using a MiddleWare at loggin :

$response = $http->post('http://myproject.local/proxify/oauth/token', [
                'form_params' => [
                    'grant_type'    => 'password',
                    'username'      => $request->get('email'),
                    'password'      => $request->get('password'),
                ]
            ]);

This is working well, excepting the fact that I'm setting cookies in the Proxify::makeRequest, so I have to create them in the call, return them in the $response, and then at the end of the Middleware, attaching them to the request (Cookie::queue and Cookie::Make are not working in a Guzzle call it seems).

The access token is created and stored in a cookie.

First problem is that in this call, even in the middleware, and especially in that URL http://myproject.local/proxify/oauth/token, I don't have any access to the Auth trait, even if it's specified as a middleware attached to the route, so impossible to fetch information from the authenticated user.

Then the other problem is that when I'm making a call to get a ressource API such as :

$http = new Client();

$response = $http->get('http://myproject.local/proxify/api/continents');

$continents = $response->getBody()->getContents();

return view('dashboard')->with("continents", $continents);

In that case, when I'm calling the URL, the proxy is not able to get the access_token defined in the cookie with the CookieFacade through the HTTP call, neither the Auth object I'm whiling to use. The $_COOKIE variable is not working neither.

What is wrong with my structure so that I don't have any access to the cookie even if it's set and in the browser ? Any other way to get the info ? I tried to get the cookie from the request in the proxy, not working.

via Chebli Mohamed