Simple user roles middleware

Hello Trying create Simple user roles middleware

in Role model

    protected $table = 'roles';

    public function users()
    {
        return $this->hasMany(User::class);
    }

in User Model

    public function role()
    {
        return $this->belongsTo(Role::class);
    }

User DB I have role_id And Role DB looks like:

        Schema::create('roles', function (Blueprint $table) {
            $table->id();
            $table->string('name');
			$table->string('description');
            $table->timestamps();
        });

Using Middleware CheckRole

Kernel.php

  'roles' => \App\Http\Middleware\CheckRole::class,

Middleware CheckRole

    public function handle(Request $request, Closure $next, $roles)
    {

			if(auth()->check() && $request->user()->role->name == $roles)
			{		 
			return $next($request);
			}	
	 
		return redirect()->route('login');

    }

route

Route::middleware(['auth', 'roles:Administrator'])->group(function(){
Route::get('/admin/posts', [App\Http\Controllers\PostController::class, 'index'])->name('post.index');
});

Using this code, restriction works, user must have Administrator role to access route.

But I have 2 questions

Q1. I want use several roles Route::middleware(['auth', 'roles:Administrator,Editor'])

in Middleware CheckRole add check for array but something not working

    public function handle(Request $request, Closure $next, $roles)
    {

		if(is_array($roles)){

			foreach($roles as $role){
				if($request->user()->role->name == $role) {
					return $next($request);
				}
			}

		} 

			if(auth()->check() && $request->user()->role->name == $roles)
			{		 
			return $next($request);
			}	
	 
		return redirect()->route('login');

    }

Q2.

is anything I need add in middleware for more security ?

jamesmtemple0429

5 years ago

Best Answer

Level 6

In order to have the middleware support a list, you'd have to do something like this: This would only allow access if the user is logged in, and has one of the roles. As far as additional security, it seems secure enough to me. It'll work in the vast majority of applications.

public function handle(Request $request, Closure $next, ...$roles)
    {
			$allowAccess = false;

			if(auth()->check())
			{
				foreach($roles as $role) {
					if($request->user()->role->name === $role) {
						$allowAccess = true;
					}
				}		 
			}

			if(!$allowAccess) {
				return redirect()->route('login');
			}

			return $next($request);	

    }

1 like

Laracast13

5 years ago

Level 4

Hi Getting error : Invalid argument supplied for foreach()

p.s. what is difference using .. dot

public function handle(Request $request, Closure $next, $roles)
vs
public function handle(Request $request, Closure $next, ...$roles)

jamesmtemple0429

5 years ago

Level 6

What version of PHP are you using?

$roles would only return the first role, not the entire list; However, ...$roles returns the entire list passed

guybrush_threepwood

5 years ago

Level 33

Just a quick comment: you could break out of the loop as soon as you find a valid role in order to avoid unnecesary checks:

			if(auth()->check())
			{
				foreach($roles as $role) {
					if($request->user()->role->name === $role) {
						$allowAccess = true;
                        break;
					}
				}		 
			}

1 like

Please or to participate in this conversation.