Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

tinkerbell's avatar

Is there a way to protect my global routes in laravel?

I have two different user roles ( admin, sales-admin) I have created a middleware for each of them to see different views, and it works perfectly. on the other hand, I have some public routes everyone can access them

how it's working now:when I login as sales-admin I can see my views + global routes as a logged sales user

what I want is: when I login as sales-admin be able to see my views (www.mywebsite.com.salesadmin) and + if sales-admin hits a public URL like(www.mywebsite.com) make them logout then be able to see the public routes

0 likes
8 replies
tykus's avatar

You can use the guest middleware on the public routes.

tinkerbell's avatar

@tykus I tried this I am facing this 127.0.0.1 redirected you too many times.

tykus's avatar

Can you show how you used the guest middleware?

tinkerbell's avatar

@tykus I have these routes as public

Route::middleware(['guest'])->group(function () {
   // pages
    Route::get('/', [HomeController::class, 'index'])->name('index');
    Route::view('/about', "frontend.pages.about")->name('about');
    Route::get('/match-detail/{match}', [PageController::class, 'matchDetail'])->name('matchDetail');
});

my sales admin routes

Route::group(['middleware' => ['auth' , 'user.sales-admin'], 'as' => 'salesadmin.'], function () {
    // pages
    Route::get('/', [HomeController::class, 'index'])->name('index');
    Route::view('/about', "sales-admin.frontend.pages.about")->name('about')
});
tinkerbell's avatar

@tykus if the user login as sales admin the route for about and index is working like that I forget to mention I have

'prefix' =>'salesadmin' in my salesadmin routes ​

https://mywebsite.com/salesadmin
https://mywebsite.com/salesadmin/about

public or guest users can see like

https://mywebsite.com
https://mywebsite.com/about
tykus's avatar

@tinkerbell if you also add the following to the AppServiceProvider, it will automatically sign out the authenticated user.

RedirectIfAuthenticated::redirectUsing(function ($request) {
    auth()->logout();
    return redirect($request->path);
});

This is not the best UX, so you might want to confirm the signing out action before it is done

1 like

Please or to participate in this conversation.