Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

shiliii's avatar

cannot access admin page

I'm beginner at laravel and I'm sorry if my english is not good. So I make a custom middleware 'IsAdmin' like this

class IsAdmin
{
    /**
     * Handle an incoming request.
     *
     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
     */
    public function handle(Request $request, Closure $next)
    {
        if(Auth::guard('web')->check()){
            return abort(403);
        }
        return $next($request);
    }
}

I've inserted the 'admin' in kernel.php. Then here's my login controller that checking if the user is admin or not with guard.

   public function authenticate(Request $request){

        $this->validate($request, [
            'login' => 'required',
            'password' => 'required|min:8'
        ]);
        
        // $login_type = filter_var($request->input('login'), FILTER_VALIDATE_EMAIL)
        //     ? 'email'
        //     : 'username';

        if (filter_var($request->input('login'), FILTER_VALIDATE_EMAIL)) {
            $login_type = 'email';
        } else {
            $login_type = 'username';
        }
        
        $request->merge([
            $login_type => $request->input('login')
        ]);

        $credentials = $request->only($login_type, 'password');

        $remember_me = $request->has('remember_me');
        
        if(Auth::guard('admin')->attempt($credentials, $remember_me)){
            if (session_status() == PHP_SESSION_ACTIVE) {
                session()->regenerate();
            }
            return redirect()->intended('/admin');
        }
        if(Auth::guard('web')->attempt($credentials, $remember_me)){
            if (session_status() == PHP_SESSION_ACTIVE) {
                session()->regenerate();
            }
            return redirect()->intended('/');
        }

        session()->flash('loginError', 'Login gagal!');

        return back();

    }

Here's the modification of auth.php:

    'defaults' => [
        'guard' => 'web',
        'passwords' => 'users',
    ],

    'guards' => [
        'web' => [
            'driver' => 'session',
            'provider' => 'users',
        ],
        'admin' => [
            'driver' => 'session',
            'provider' => 'admins',
        ],
    ],

    'providers' => [
        'users' => [
            'driver' => 'eloquent',
            'model' => App\Models\User::class,
        ],
        'admins' => [
            'driver' => 'eloquent',
            'model' => App\Models\Admin::class,
        ],
],

and then there's this route:

Route::prefix('admin')->middleware(['admin'])->group(function(){
    Route::get('/', [AdminController::class, 'index']);
    Route::resource('/sc', AdminScController::class, ['expect' => 'show']);
    Route::resource('/mbkm', AdminMbkmController::class);
    Route::resource('/faculty', AdminFacultyController::class);
    Route::resource('/user', AdminUserController::class);
});

The thing is, I cannot login with admin account when the middleware I set is 'admin'. Yet I can access the admin page if I set the middleware with 'auth:admin'. I know it works too, but I want to make a 403 page appear if they're trying to access admin page when they aren't admin as if I use 'auth:admin', the page just immediately redirect to the previous page. Can you help me what's wrong with this program?

0 likes
1 reply
vincent15000's avatar

I don't understand what you are trying to do inside the isAdmin middleware.

How is defined an admin in your application ? in your database ?

Please or to participate in this conversation.