How can I implement Laravel Basic Auth using cleartext credentials from a custom systems table?

Below is one approach to achieve what you need: bypassing Laravel’s default user provider (which uses the Users table and hashed passwords) by writing your own middleware that manually fetches the credentials from the request and verifies them against your systems table.

Custom Middleware Example

Create a middleware (for example, SystemBasicAuth) in your app's middleware directory:

PHPCopied
<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;
use App\Models\System;

class SystemBasicAuth
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure(\Illuminate\Http\Request): \Symfony\Component\HttpFoundation\Response  $next
     * @return \Symfony\Component\HttpFoundation\Response
     */
    public function handle(Request $request, Closure $next): Response
    {
        // Retrieve the credentials from the HTTP basic auth header.
        $username = $request->getUser();
        $password = $request->getPassword();

        // Check that both credentials have been provided.
        if (! $username || ! $password) {
            return $this->unauthorizedResponse();
        }
        
        // Look up the system by username.
        $system = System::where('systemUsername', $username)->first();
        
        // Here we use a plain text comparison.
        if (! $system || $system->systemPassword !== $password) {
            return $this->unauthorizedResponse();
        }
        
        // Optionally, you could attach the system model to the request if needed:
        // $request->attributes->set('system', $system);
        
        return $next($request);
    }

    /**
     * Return an unauthorized response with the proper headers.
     *
     * @return \Symfony\Component\HttpFoundation\Response
     */
    protected function unauthorizedResponse(): Response
    {
        $headers = ['WWW-Authenticate' => 'Basic realm="Access denied"'];
        return response('Invalid credentials.', 401, $headers);
    }
}

Registering the Middleware

To use your custom middleware, register it in your HTTP kernel. Open app/Http/Kernel.php and add an entry to either the $routeMiddleware array:

PHPCopied
protected $routeMiddleware = [
    // ...
    'system.auth' => \App\Http\Middleware\SystemBasicAuth::class,
];

Attaching the Middleware to a Route

Now you can attach it to any route that needs basic auth for your systems.

PHPCopied
use Illuminate\Support\Facades\Route;

Route::get('/download', function () {
    // Your download logic here.
})->middleware('system.auth');

Explanation

• The middleware uses the $request->getUser() and $request->getPassword() methods to pull the credentials from the HTTP basic auth header.
• It then queries your systems table (assuming an Eloquent model named System) to find the system by the provided username.
• A simple plain text comparison is used to validate the password.
• If the credentials are missing or invalid, the middleware returns a 401 Unauthorized response with a WWW-Authenticate header.
• When valid, the middleware passes the request along.

This setup lets you perform basic auth against a custom table with cleartext credentials, without interfering with your default authentication setup.