Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

evaglaude48's avatar

What is best way of laravel sanctum role based access?

Hi there,

I did role based access using following code. It's working fine. Now want to know, is it good way? If not then which approach is better or bet?

const router = new Router({routes,mode:'history'})

 function loggedIn() {

    if(localStorage.getItem('token')){
        window.axios.defaults.headers.common['Authorization'] = 'Bearer ' + localStorage.getItem('token');
        return true;
    }else{
        return false;
    }
}

router.beforeEach((to, from, next) => {
    if (to.matched.some(record => record.meta.requiresAuth)){
        if(!loggedIn()){
            next({
                path: '/auth/login',
                query: { redirect: to.fullPath }
            })
        }else{
            if(to.matched.some(record => record.meta.managerAuth)){
                const role = localStorage.getItem('role')
                if(role === 'manager'){
                    next()
                }else if(role === 'admin'){
                    next('/admin')
                }else if(role === 'employee'){
                    next('/employee')
                }
            }else if(to.matched.some(record => record.meta.isAdmin)){
                const role = localStorage.getItem('role')
                if(role === 'admin'){
                    next()
                }else if(role === 'manager'){
                    next('/')
                }else if(role === 'employee'){
                    next('/employee')
                }
            }else if(to.matched.some(record => record.meta.isEmployee)){
                const role = localStorage.getItem('role')
                if(role === 'employee'){
                    next()
                }else if(role === 'manager'){
                    next('/')
                }else if(role === 'admin'){
                    next('/admin')
                }
            }
        }
    }else if(to.matched.some(record => record.meta.guest)){
        if(loggedIn()){
            next({
                path: '/',
                query: { redirect: to.fullPath }
            })
        }else{
            next()
        }
    }
});

export default router;

Thanks in advance

0 likes
1 reply
martinbean's avatar

@evaglaude48 You’re using Sanctum in completely the wrong way. Sanctum was literally made so you don’t have to put sensitive information like API tokens in local storage 🤦‍♂️

Read the docs and use Sanctum properly.

Please or to participate in this conversation.