Restful service or not?

Question

Laravel

As a practice, I decided to write a standard blog on restful api.
If I correctly understood all his "logic" of course.
Now added registration with authorization. I tested everything on jquery (ajax), everything seems to work.
And so, logic:
There is an ajax request on / api/v1/auth, login and the password are transferred. Here immediately the question is:
Do I need to set conditions for the name of the fields or is it better to do it as an array?
If the validation is not successful, then I throw out a json error with code 412, if everything is fine, I check the correspondence of the login and password in the database (of course, I use password_hash), if not successful, I throw Json:
status => error, if everything is successful, then a random value is written to the 'remember_token' cell and I give it out in the response.
So, is this correct? That is, the service, according to the idea, should not store anything, and the client should save this token in cookies (for example), and send it to me with each request, and all the "logic" will be through it?
Thanks

Answer 1

According to the standard, the Error Code should be given in the server response header, for example - authorization error Status: 401. And in json, you additionally give an explanation of the error or debug information. By the way, Laravel 5.3 has ready-made routes for api - you don't need to invent anything. Just throw Exception in any part of the application and Laravel catches them and gives json.
Upon successful authorization, give the token in json. The client must store this, the front end uses local_storage for this.
The front adds a token from the storage to the headers with each request, and the server validates it. According to the standard, the token should be stored only by the client (as opposed to the session). It should also have a short lifespan. And a slightly longer refresh time. Those. if the token is not valid, then you throw it on a special route, which, based on it, will issue a valid token.
PS JWT implementation for laravel

Answer 2

here