DEV Community: Mohamed Fakhr

Stateful vs Stateless Authentication

Mohamed Fakhr — Mon, 20 Jul 2026 12:38:38 +0000

Stateful Authentication
Session-based: Relies on server-side sessions to maintain user state.
How it works: When a user logs in, a session is created on the server, and a session ID is stored in a cookie on the client. Subsequent requests include the session ID, allowing the server to identify the user.
Advantages: Simple to implement, good for traditional web applications.
Disadvantages: Scalability issues with large user bases, vulnerability to session hijacking, and state management complexity.

Stateless Authentication
Token-based: Relies on tokens (usually JWTs) instead of sessions.
How it works: After successful authentication, a JWT containing user information is issued. Subsequent requests include the token in the authorization header. The server validates the token without maintaining user state.
Advantages: Scalability, security, and flexibility.
Disadvantages: Increased complexity in token management and potential for larger payloads.

When to Use Which
Stateful Authentication: Suitable for traditional web applications where user experience is prioritized and scalability is not a major concern.

Stateless Authentication: Ideal for APIs, mobile applications, and single-page applications (SPAs) where scalability, security, and statelessness are essential.

Laravel Request Lifecycle

Mohamed Fakhr — Sun, 19 Jul 2026 16:59:03 +0000

1. Request Entry Point

The request begins at public/index.php. This file is the entry point for all incoming requests by your web server (Apache / Nginx) configuration.
It loads the Composer autoloader and instantiates the Laravel application from bootstrap/app.php.

2. Kernel Initialization
This kernel is responsible for handling HTTP requests and managing middleware. The request is sent to either the HTTP kernel or the console kernel, depending on the type of request. Kernels serve as the central location where all requests flow. Just focus on the HTTP kernel, which is located in app/Http/Kernel.php.

The Illuminate\Foundation\Http\Kernel class is instantiated, which defines "an array of bootstrappers", which refers to a list of classes that will be run before the request is executed. These bootstrappers configure

Error handling
Logging
Authentication & Authorization
Detect the application environment

Also defines a list of HTTP middleware that all requests must pass through before being handled by the application. This middleware handles

Reading and writing the HTTP session
Verifying the cross-site request forgery (CSRF) token.

Call the handle method in all middlewares, then after the response, call the terminate method, which runs after the request

3. Service Providers

One of the most important kernel bootstrapping actions is loading the service providers for your application.
Service providers are responsible for bootstrapping all of the framework's various components, such as the database, queue, validation, and routing components.
Service Providers are listed in config/app.php. This is the master list or array of all the service providers Laravel will load for your application.
Laravel loops through them. When Laravel starts up (bootstraps), it goes through each provider in that list and creates (instantiates) an object of each service provider class.
register() is called first on all providers. Purpose of register(): You tell Laravel’s service container how to build certain classes, bind interfaces, or configure services.
After all providers are registered, Laravel then calls the boot() method on each one.

-Why does Laravel call the boot() method after register() in a service provider?
Because by the time boot() runs, all other service providers have been registered, you can safely use the services that those providers have registered.

-Why are Service Providers so important?
Essentially, every major feature offered by Laravel is bootstrapped and configured by a service provider. Everything in Laravel — routing, queues, events, mail, validation, etc. — is set up by these providers. When you install a package (like Cashier, Horizon, etc.), you often add its service provider to config/app.php so Laravel knows how to register and boot it.

4. Route Matching

One of the most important service providers in your application is the App\Providers\RouteServiceProvider. This service provider loads the route files contained within your application's routes directory.
Once the application has been bootstrapped and all service providers have been registered, the Request will be handed off to the router, which will dispatch the request to a route or controller.

5. Controller Invocation

Once a matching route is found, the associated controller method is executed.
The controller handles the request logic, interacts with models, and prepares the response.
The controller returns a response, which can be a view, JSON, or other formats.
Laravel converts the response into an HTTP response object.

7. Middleware Termination
The request passes through the middleware again, allowing for any final actions (e.g., logging, error handling).

8. Response Sending
The HTTP kernel's handle method returns the response object, and the index.php file calls the send method on the returned response. The send method sends the response content to the user's web browser.

Laravel Autoloader

Mohamed Fakhr — Sat, 18 Jul 2026 19:00:27 +0000

What is an Autoloader?
An autoloader is a piece of code that automatically loads classes when they are needed, without requiring explicit include or require statements. This saves developers from manually managing file inclusion and improves code organization.

How it works:
Composer Installation: When you create a new Laravel project, Composer installs the required packages and generates the autoloader file. Composer also is a package management system as npm for nodejs.
Autoloader Activation: Laravel's autoloader is triggered. It examines the class name and tries to locate the corresponding file. If the file is found, it's included, making the class available for use.

The Concept Behind Laravel's Autoloader
(PSR-4) Autoloading Standard: PHP Standard Recommendation for autoloading. This standard defines a mapping between class names and file paths.
Namespace Mapping: Laravel uses namespaces to organize classes. The autoloader maps namespaces to specific directories within your project structure.
Classmap Generation: Composer creates a classmap, which is a lookup table that maps class names to their file paths, optimizing performance.

What is composer.lock?
The composer.lock file is auto-generated by Composer.
Purpose:
It locks exact versions of every package (and their dependencies).
Ensures the project runs the same way for every developer or deployment.
Keeps installs consistent across environments.

That's why some developers don't commit and push composer.lock file so every package is installed with dependence on every developer environment.