Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

GimmeMylanta's avatar

Refuse all web routes for pure API

Hey Guys,

I am writing a pure API implementation and i want to deny all routes that aren't done without the JSON format.

So far in my web route I have the following;

Route::any('{any}', function () {
    abort(403, 'Unauthorized action.');
});

Which works fine for routes that dont exist in the api routes file.

But if I try and access /api/user from in the browser, I get a Route [login] not defined.

Is there a way I can set it so that if a user enters a valid API route in a web browser, or anywhere which doesnt send data in json format, it will return the same abort message as I have defined in the web file?

0 likes
4 replies
tisuchi's avatar

@chris1981

Yes, I understand.

The problem is that, when you request some endpoint that is not authenticated, so it will be redirected to the login page.

So, once it redirects to the login page after being unauthenticated, it doesn't found the login route. That's why you are getting this error.

fylzero's avatar

@chris1981 Stupid question... Is your "any" route at the bottom of the api route file?

24 likes

Please or to participate in this conversation.