如何通过Laravel 5.2中的登录角色保护路由？

Question

I am using laravel 5.2. I have a problem when the login, they can open the page if they know the URL. This below is my navbar menu :

@if(Session::get('Mem_Username') == 'Guest')
<li>
<a href="{{ url ('Client') }}"><i class="fa fa-building fa-fw"></i> Client List</a>
</li>
@endif
@if(Session::get('Mem_Role') == '1')
<li>
<a href="{{ url ('Lead') }}"><i class="fa fa-th-list fa-fw"></i> Leads</a>
</li>
<li>
<a href="{{ url ('Client') }}"><i class="fa fa-building fa-fw"></i> Client List</a>
</li>
@elseif(Session::get('Mem_Role') == '2')
<li>
<a href="{{ url ('Lead') }}"><i class="fa fa-th-list fa-fw"></i> Leads</a>
</li>
@endif

And I already put this in each of the controller

public function __construct()
{
    $this->middleware('auth');
}

By the way, I am changing the Authenticate.php file using Session into like this below:

public function handle($request, Closure $next, $guard = null)
    {
        if(Session::has('Mem_Username')){

        }
        else{
            return redirect()->guest('');
        }

        return $next($request);
    }

Answer 1

php artisan make :middleware AdminMiddleware

It will create a new middleware under: App/Http/Middleware open the middleware, place the code:

public function handle($request, Closure $next)
{
    if(!auth->user()->isAdmin()){
        abort(404);
    }
    return next($request);
}

and under user model make sure you have a isAdmin() method that checks wether the current user is admin.

Registering a Middleware

Now that we've created a middleware, we need to let the application know the middleware exists. If you want a middleware to run on every request, go to app/Http/kernel.php and add the middleware ' isAdmin ' to Kernel class $middleware property .

protected $middleware = [
    ...
    \App\Http\Middleware\AdminMiddleware::class
];

If you want the middleware to trigger on some routes, we can name the middleware and use that as a reference mechanism to add it to some routes. To name the middleware, while still in the app/Http/kernel.php , add the keyed property to the $routeMiddleware array. The array key is the name of the middleware, while the value should be the isAdmin of the middleware.

protected $routeMiddleware = [
    ...
    'isAdmin' => \App\Http\Middleware\AdminMiddleware::class,
    ...
];

Then you can protect your routes with this middleware.

Route:get('someurl', 'Controller')->middleware('isAdmin');