Laravel 5.3 protecting routes from user have different roles

Question

problem

I'm looking for a way to protect users from access routes which do not belong to them, example admin cannot access user area and simple user cannot access admin area

Hi, i've a laravel 5.3 app and it has two types of users

1. Admin
2. Simple User

i'm trying to prevent admin from accessing simple user routes and vice-versa, I search a lot and found one solution of creating a middleware

what i've done

<?php

namespace App\Http\Middleware;

use Auth;

use Closure;

class UserRole
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        if ( Auth::check()) // user logged
        {
            $request_url = $request->getRequestUri();
            if( Auth::user()->user_type == 1 ) // simple user
            {
                // checking if simple user is visiting routes              // starts with /user in the url 
                if (strpos($request_url, "/user") === 0)
                {
                    return $next($request);
                }
                else
                {
                    return redirect('/');
                }
            }
            // checking if admin is visiting routes                    // starts with /admin in the url
            else if( Auth::user()->user_type == 2 ) // admin
            {
                if (strpos($request_url, "/admin") === 0)
                {
                    return $next($request);
                }
                else
                {
                    return redirect('/');
                }
            }
            else
            {
                return redirect('/');
            }
        }
        return redirect('/');
    }
}

unfortunately both are able to access each others restricted areas. I'm unable to find a better way to protect user from accessing routes which they don't have access too.

Answer 1

If you want to accomplish that using middleware you need to do following -

1. Create two middlewares, one for admin and one for simple user.

2. Then create two route group in your routes file ie routes/web.php

3. Protect one route group with admin middleware, and put all of your admin related routes in that group. Protect another route group with simple-user middleware and put all of your admin related routes in that group.

Route::group(['middleware' => ['auth', 'admin']], function() {
    // put all your admin routes here
});

Route::group(['middleware' => ['auth', 'simple-user']], function() {
    // put all your simple user routes here
});

You can also accomplish that using role and permission. Here is a package that can satisfy your needs.

https://packagist.org/packages/zizaco/entrust