Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

Jman's avatar
Level 1

Middleware causes Route Note Defined error..?

Hi all,

I'm working with Middleware for the first time and hit an issue I can't figure out.

I have users, and users can have a business. Naturally, I don't want users editing each others businesses by manually entering the business id in the url. Middleware seems like the right approach here. However, when I add the middleware to the route, I get an error saying that a route that is used in the view (the destination for the form in the edit view) is not defined. Which is incorrect, because it is correctly named and works just fine when I remove the '->middleware()' call.

The confusing thing is, I'm using a debugger and I can't seem to get it to hit the breakpoint I've set in the middleware. And if I 'dd($business)' in the view, when using the Middleware, it seems the '$business' variable is null, but without the Middleware the model is correctly assigned.

Completely lost, and I can't seem to narrow this one down any further...

Any ideas?

Route

/**
 * Frontend Controllers
 * All route names are prefixed with 'frontend.'.
 */
Route::get('business/{business}/edit', 'BusinessController@edit')->name('business.edit')->middleware('verify_business_owner:'.$business->id);
Route::patch('business/{business}', 'BusinessController@update')->name('business.update');

Kernel.php

protected $routeMiddleware = [
        'auth' => \Illuminate\Auth\Middleware\Authenticate::class,
        'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
        'bindings' => \Illuminate\Routing\Middleware\SubstituteBindings::class,
        'can' => \Illuminate\Auth\Middleware\Authorize::class,
        'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
        'password_expires' => \App\Http\Middleware\PasswordExpires::class,
        'permission' => \Spatie\Permission\Middlewares\PermissionMiddleware::class,
        'role' => \Spatie\Permission\Middlewares\RoleMiddleware::class,
        'signed' => \Illuminate\Routing\Middleware\ValidateSignature::class,
        'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
        'verify_business_owner' => \App\Http\Middleware\VerifyBusinessOwner::class
    ];

Middleware

namespace App\Http\Middleware;

use Closure;
use App\Models\Business;

class VerifyBusinessOwner
{
    /**
     * Handle an incoming request.
     * @todo improve check with function in model


     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next, Business $business)
    {
        $response = $next($request);

        $user = $request->user();
        if($business->user_id != $user->id){
            return redirect('home');
        }

        return $response;
    }
}
0 likes
4 replies
Jman's avatar
Level 1

@biishmar I think you're right there, thanks, I'll look into that.

For future reference I'd still be interested in knowing where I went wrong with this one.

Cheers!

DevFromRotterdam's avatar

I would keep such conditionals at the controllerlevel, like so:

$business = business::find($id);

if(auth()->id() >= 1 && $business->user->id == auth()->id()) {

// authorize

}

Jman's avatar
Level 1

Thanks @DevFromRotterdam, that was my initial though but I felt like addressing this at the route level might reduce duplication of logic. However, no harm in starting at the controller and abstracting later if/when needed. Thanks!

Please or to participate in this conversation.