Laravel How Authorization works

Learn how Laravel's authentication works with a simple example. Deep dive into the authentication process & see how to protect your app!

How Authorization Works in Laravel

Authorization in Laravel is the process of determining whether a user is allowed to perform an action or not. In the context of web applications, authorization is usually done using access control lists (ACLs) that specify who is allowed to access what resources. With Laravel, authorization is handled using a combination of policies and gates.

Policies are classes that contain all the authorization logic for a given resource. For example, a PostPolicy might contain all the logic for authorizing users to view, create, update, and delete posts. In addition to the policies, Laravel also provides gates, which are simple functions that determine whether a user is allowed to perform a particular action or not. For example, you could define a canEditPost gate that checks if the currently logged in user is allowed to edit a post.

Let’s take a look at a simple example of how authorization works in Laravel. Suppose we have a Post model with a canEditPost gate. We can define this gate in the AuthServiceProvider.php file like so:

public function boot()
{
    Gate::define('canEditPost', function ($user, $post) {
        return $user->id === $post->user_id;
    });
}

This gate checks if the currently logged in user is the same as the user who wrote the post. If so, the gate will return true, meaning the user is allowed to edit the post. Otherwise, it will return false, meaning the user is not allowed to edit the post.

We can then call this gate in our controller or views to check if the user is allowed to perform an action:

if (Gate::allows('canEditPost', $post)) {
    // The user is allowed to edit the post...
} else {
    // The user is not allowed to edit the post...
}

In addition to gates, policies can also be used to check if a user is allowed to perform a certain action. Policies are generally used when a more complex authorization logic is needed. To use a policy, you can call its authorize method in your controller or views:

if (Gate::allows('canEditPost', $post)) {
    // The user is allowed to edit the post...
} else {
    // The user is not allowed to edit the post...
}

In this example, we’ve seen how authorization works in Laravel using both gates and policies. Gates are useful for simple authorization logic, while policies are better suited for more complex authorization scenarios. Both gates and policies can be used together to provide a powerful and flexible authorization system for your Laravel applications.