Authorize function is not working with middleware | Laravel

Question

I have an authorization using middleware where Function could only run when authorized

this is my middleware:

class IsAdmin
{
    public function handle($request, Closure $next)
    {
        if (auth()->check() && auth()->user()->is_admin == 1) {
            return $next($request);
        }

        return abort(403, 'Forbidden');
    }
}

my Controller:

public function destroy(int $bookId, int $reviewId, Request $request)
{
    // @TODO implement

    $check_bookReview = BookReview::firstWhere('id', $reviewId)->where('book_id', $bookId);
    if ($check_bookReview && isAdmin()) {
        BookReview::destroy($reviewId);
        return response()->noContent();
    } else {
        abort(404);
    }
}

and my api.php as well my Kernel:

'auth.admin' => \App\Http\Middleware\IsAdmin::class

Route::group(['middleware' => ['auth.admin']], function (){
Route::post('/books', 'BooksController@store');
Route::post('/books/{id}/reviews', 'BooksReviewController@store');
Route::delete('/books/{bookId}/reviews/{reviewId}', 'BooksReviewController@destroy');
});

and i have a User db field where it contains api_token and is_admin like below:

and my Postman still return 403 forbidden while i already gave an authorization by headers:

what should i do here, to fulfill my function?

Ksi · Accepted Answer · 2022-08-21 05:45:47Z

1

Looks like your Authenticate middleware is not working, so it likely fails on auth()->check().

Make sure to use the auth middleware from Laravel, you can also use a guard as described here: https://laravel.com/docs/9.x/authentication#protecting-routes

answered Aug 21, 2022 at 5:45

Ksi

1774 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

info.dava Over a year ago

i've changed it into auth middleware from laravel, its still the same, what i don't understand is am i doing the correct way on my postman?

Ksi Over a year ago

Still the same meaning what error exactly? (You have suspicious isAdmin() function call in the controller which shouldn’t be there..

info.dava Over a year ago

isAdmin() is my middleware class for authorization in my route, the error is forbidden 403 in postman which when I implement middleware auth in my route

Ksi Over a year ago

Show the error. Also I mean the IsAdmin() function call you have in the controller which shouldn’t be there.

info.dava Over a year ago

the error is in the picture above, the postman one. i put it on the controller to check if user isAdmin() then function can run else 404

|

Collectives™ on Stack Overflow

Authorize function is not working with middleware | Laravel

1 Answer 1

6 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Related