In this post, I would like to show you very simple approach to develop a security layer around Laravel routes with custom Middleware.
Middleware provides a convenient mechanism for filtering HTTP requests entering your application. middleware are series of “layers” where HTTP requests must pass through before they hit your application. Each layer can examine the request and even reject it entirely.
We will be using the following tables:
users: This table stores all of the user data.
roles: This table stores all of the roles lists.
For the sake of simplicity in this tutorial, one user can have only one role, so the role_id column added to the users’ table.
Generating and Running the Migrations
By default, Laravel 5 comes with a user table migration so just update it by adding
Now we need role migration, to create a roles table, generate a new migration by running
php artisan make:migration create_roles_table and add the following code to it.
Now we have required migrations in place, to create tables run them using
php artisan migrate.
Creating and updating Models
By default, Laravel 5 comes with a
User model, so we do not have to create it. But We need to update it by adding the role method to it.
Add the following to the
Now we need a
Role model, to generate run the following command
php artisan make:model Role.
App\Role model might be like below shown text
Adding a middleware to provide role based access control is just as simple. To create a new middleware, use the
make:middleware Artisan command:
Above command will place a new
RoleGate class within your
app/Http/Middleware directory. In this middleware, we will only allow access to the route if the supplied role is assigned to the user. Otherwise, we will redirect the users back to the login URI.
As you can see, if the given role is assigned to the currently authenticated user, the request will be passed further into the application, otherwise, the middleware will return an HTTP redirect to the login URI. To pass the request deeper into the application (allowing the middleware to “pass”), simply call the
$next callback with the
app/Http/Kernel.php and add your newly RoleGate middleware to the application’s route middleware’s array as shown below –
How use it to protect roles
Once the middleware has been defined in the HTTP kernel, you may use the middleware method to assign middleware to a route:
I hope you like this Post, Please feel free to comment below, your suggestion and problems if you face - we are here to solve your problems.