Level 122
if its only 1 or 2 admins, and you don't need different levels of control, then a flag on the user model , and a simple middleware works just fine.
2 likes
Oct 22, 2021
6
Level 1
What is the best way to implement an admin user
I've seen some ways to implement an admin account into a laravel project (with CRUD/dashboard acess privileges):
- Implementing an is_admin field into the User table.
- Implementing an Admin model with a middleware/controllers/guards
- Adding some keys to the .env file (name, email, password). Adding an admin.php file in the conf directory with access to those keys and a seeder.
- using administrative interface builders.
I want to know what is, in your opinion, the most efficient and secure way to do it.
Level 1
@Snapey Thanks, I'll try that then
Level 80
@galaners Simplest way is a is_admin column in your users table, and some middleware that you can apply to admin-only routes:
class EnsureUserIsAdministrator
{
public function handle(Request $request, Closure $next)
{
if ($request->user()->is_admin) {
return $next($request);
}
abort(403, 'You are not an administrator');
}
}
1 like
Level 75
@galaners authorization is all you need, a user logs in with a role or roles, and then let authorization determine what the logged in user can or cannot do. @jeffreyway has free videos on this.
1 like
Level 54
I think you should also consider ACL (roles and permissions) as well
1 like
Level 8
I just watched a Larabit today where Jeffrey Way said, essentially, if you need something simple, make it simple.
In that particular video, he added an admin guard that simply checked if the user object had a particular email associated with it. Doesn't get much simpler than that. Or as @snapey pointed out, it can be a method or boolean flag on the user model.
However I do feel that there is merit to building elastic solutions early on to prevent expensive refactoring. If you feel like you may need the admin position to be more flexible than an array of emails, maybe if you are building some kind of CMS, then there are great packages out there for assigning roles and permissions. Spatie Laravel Permissions comes to mind.
1 like
Please or to participate in this conversation.