what does $guard do

When I was reading web blogs about multi authentication I asked myself the same question: "What is the goal of $guard in my model?". After exploring I understood that there is no sense in this and we can just remove this line of code. I think the author of first blog made mistake and other people who was wrining own ones just copied this mistake too. User model can containg similar property $guarded which we use in Mass Assignment as a attributes black list contrary to $fillable as white list.

Besides, $guard attribute was in AuthenticatesUsers trait in privious laravel versions before 5.3.

protected function getGuard()
 {
     return property_exists($this, 'guard') ? $this->guard : null;
 }

In 5.3 this method has been replaced:

protected function guard()
 {
    return Auth::guard();
 }

So after 5.2 $guard propery doesn't exists anymore. AuthenticatesUsers trait we use in LoginController and in order to set guard we should override guard method but < 5.3 we need set protected $guard = 'custom guard name' in correspond authentication controller:

/*> 5.2*/
class LoginController extends Controller
{
    use AuthenticatesUsers;    
 
    protected $redirectTo = RouteServiceProvider::HOME;
  
    public function __construct()
    {
        $this->middleware('guest')->except('logout');
    }

    protected function guard()
    {
        return Auth::guard('custom guard name');
    }
}

/*< 5.3*/
class AuthController extends Controller
{
    use AuthenticatesAndRegistersUsers, ThrottlesLogins;

    protected $redirectPath = '/';
    protected $guard = 'custom guard name';
}

Laravel’s authentication facilities are made up of “guards” and also “providers”. Guards define how users are authenticated for each request. For example, Laravel ships with a session guard that maintains state using session storage and cookies.

Laravel provides different guards like sessions and tokens. The session guard maintains the state of the user in each request by cookies, and on the other hand, the token guard authenticates the user by checking a valid token in every request.

And protected $guard is used to protect your database from a mass assignment.

Actually gaurd define how the system should store and retrieve information about your users.

You can find the file location in your config/auth.php file and you can configure. There are mainly two gaurd one id "web" and another is "api" guard.

1) A web guard is the traditional cookie store - so that web guard instructs Laravel to store and retrieve session information.

2) The API guard, on the other hand, uses tokens. So you would use the API guard if you want to authenticate users and requests using an API token in the header (bearer) or query parameter.

There is no restiction on creating own guard.

Here is sample of creating own guard in laravel Place the $guard in model like example :

app/Dealer.php

namespace App;

use Illuminate\Notifications\Notifiable;
use Illuminate\Foundation\Auth\User as Authenticatable;

class Dealer extends Authenticatable
{
    use Notifiable;

    protected $guard = 'dealer';

}

config/auth.php

<?php

[...]
'guards' => [
    [...],
    'dealer' => [
        'driver' => 'session',
        'provider' => 'dealers',
    ],
],

'providers' => [
    [...]
    'writers' => [
        'driver' => 'eloquent',
        'model' => App\Dealer::class,
    ],
],
[...]

app/Http/Controllers/Auth/LoginController.php

<?php

namespace App\Http\Controllers\Auth;

use App\Http\Controllers\Controller;
use Illuminate\Foundation\Auth\AuthenticatesUsers;
[...]
use Illuminate\Http\Request;
use Auth;
use App\Dealer;
[...]
class LoginController extends Controller
{
    [...]
    public function __construct()
    {
        $this->middleware('guest:dealer')->except('logout'); // call here
    }
    [...]
}

I'm pretty sure it's just a commonly used variable name. You should be wondering what protected means instead; This modifier is open to use within the class in which it is defined and its parent or inherited classes.

Though, i also found this regarding Laravel versions below 5.3:

In your auth.php configuration file, you may configure multiple "guards", which may be used to define authentication behavior for multiple user tables.

It's named differently after 5.3.

Laravel 5.2 and earlier used $guard to specify the guard for the PasswordController. https://laravel.com/docs/5.2/authentication#password-customization

As of Laravel 5.3, protected function guard() is used instead. See "Guard Customization" in https://laravel.com/docs/5.3/authentication#included-authenticating