I don't understand what you are trying to do inside the isAdmin middleware.
How is defined an admin in your application ? in your database ?
Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.
I'm beginner at laravel and I'm sorry if my english is not good. So I make a custom middleware 'IsAdmin' like this
class IsAdmin
{
/**
* Handle an incoming request.
*
* @param \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response) $next
*/
public function handle(Request $request, Closure $next)
{
if(Auth::guard('web')->check()){
return abort(403);
}
return $next($request);
}
}
I've inserted the 'admin' in kernel.php. Then here's my login controller that checking if the user is admin or not with guard.
public function authenticate(Request $request){
$this->validate($request, [
'login' => 'required',
'password' => 'required|min:8'
]);
// $login_type = filter_var($request->input('login'), FILTER_VALIDATE_EMAIL)
// ? 'email'
// : 'username';
if (filter_var($request->input('login'), FILTER_VALIDATE_EMAIL)) {
$login_type = 'email';
} else {
$login_type = 'username';
}
$request->merge([
$login_type => $request->input('login')
]);
$credentials = $request->only($login_type, 'password');
$remember_me = $request->has('remember_me');
if(Auth::guard('admin')->attempt($credentials, $remember_me)){
if (session_status() == PHP_SESSION_ACTIVE) {
session()->regenerate();
}
return redirect()->intended('/admin');
}
if(Auth::guard('web')->attempt($credentials, $remember_me)){
if (session_status() == PHP_SESSION_ACTIVE) {
session()->regenerate();
}
return redirect()->intended('/');
}
session()->flash('loginError', 'Login gagal!');
return back();
}
Here's the modification of auth.php:
'defaults' => [
'guard' => 'web',
'passwords' => 'users',
],
'guards' => [
'web' => [
'driver' => 'session',
'provider' => 'users',
],
'admin' => [
'driver' => 'session',
'provider' => 'admins',
],
],
'providers' => [
'users' => [
'driver' => 'eloquent',
'model' => App\Models\User::class,
],
'admins' => [
'driver' => 'eloquent',
'model' => App\Models\Admin::class,
],
],
and then there's this route:
Route::prefix('admin')->middleware(['admin'])->group(function(){
Route::get('/', [AdminController::class, 'index']);
Route::resource('/sc', AdminScController::class, ['expect' => 'show']);
Route::resource('/mbkm', AdminMbkmController::class);
Route::resource('/faculty', AdminFacultyController::class);
Route::resource('/user', AdminUserController::class);
});
The thing is, I cannot login with admin account when the middleware I set is 'admin'. Yet I can access the admin page if I set the middleware with 'auth:admin'. I know it works too, but I want to make a 403 page appear if they're trying to access admin page when they aren't admin as if I use 'auth:admin', the page just immediately redirect to the previous page. Can you help me what's wrong with this program?
Please or to participate in this conversation.