|
1 | 1 | # Protected Routes |
| 2 | + |
| 3 | +<!-- markdownlint-disable no-inline-html --> |
| 4 | + |
| 5 | +There are usually parts of your application that you want to be available to only logged in users or guest users. That's where protected routes come in. Protected routes are setup to allow users with a certain authentication status to access them. |
| 6 | + |
| 7 | +## The `user` method |
| 8 | + |
| 9 | +The `user()` method is a way to check if a user is logged in. It returns the currently logged in user if an authenticated user is found and `null` if a user is not logged in. |
| 10 | + |
| 11 | +This works for both session and token based authentication. In case of token based authentication, Leaf Auth will also check if the token is valid. If it is, the user is returned, if not, `null` is returned. You can get the reason for the authentication failure by calling the `errors()` method. |
| 12 | + |
| 13 | +```php{1,7} |
| 14 | +$user = auth()->user(); |
| 15 | +
|
| 16 | +if ($user) { |
| 17 | + // user is logged in |
| 18 | +} else { |
| 19 | + // user is not logged in |
| 20 | + $errors = auth()->errors(); |
| 21 | +} |
| 22 | +``` |
| 23 | + |
| 24 | +Using this method, you can easily protect your routes by checking if a user is logged in. If a user is not logged in, you can redirect them to the login page or return a 401 error. Here's an example: |
| 25 | + |
| 26 | +```php |
| 27 | +app()->get('/protected', function () { |
| 28 | + $user = auth()->user(); |
| 29 | + |
| 30 | + if ($user) { |
| 31 | + // user is logged in |
| 32 | + } else { |
| 33 | + // user is not logged in |
| 34 | + response()->redirect('/login'); |
| 35 | + } |
| 36 | +}); |
| 37 | +``` |
| 38 | + |
| 39 | +For API routes, you can return a 401 error if a user is not logged in. |
| 40 | + |
| 41 | +```php |
| 42 | +app()->get('/protected', function () { |
| 43 | + $user = auth()->user(); |
| 44 | + |
| 45 | + if ($user) { |
| 46 | + // user is logged in |
| 47 | + } else { |
| 48 | + // user is not logged in |
| 49 | + response()->json([ |
| 50 | + "error" => "Unauthorized", |
| 51 | + "data" => auth()->errors(), |
| 52 | + ], 401); |
| 53 | + } |
| 54 | +}); |
| 55 | +``` |
| 56 | + |
| 57 | +## The `id` method |
| 58 | + |
| 59 | +The id() method lets you get the ID of the user who is currently logged in. This is helpful when you need to work with the user's ID in your app. If no user is logged in, the method returns `null` instead. |
| 60 | + |
| 61 | +```php |
| 62 | +app()->get('/protected', function () { |
| 63 | + $id = auth()->id(); |
| 64 | + |
| 65 | + if ($id) { |
| 66 | + // user is logged in |
| 67 | + } else { |
| 68 | + // user is not logged in |
| 69 | + response()->redirect('/login'); |
| 70 | + } |
| 71 | +}); |
| 72 | +``` |
| 73 | + |
| 74 | +## Using Middleware |
| 75 | + |
| 76 | +Leaf Auth also provides a middleware that you can use to protect your routes. The `auth` middleware checks if a user is logged in and allows you to set a callback function to run if a user is not logged in. |
| 77 | + |
| 78 | +```php |
| 79 | +auth()->middleware('auth.required', function () { |
| 80 | + response()->redirect('/login'); |
| 81 | +}); |
| 82 | +``` |
| 83 | + |
| 84 | +Once you have defined a callback for the middleware, you can use it in your routes like this: |
| 85 | + |
| 86 | +```php |
| 87 | +app()->get('/protected', ['middleware' => 'auth.required', function () { |
| 88 | + // this route is protected |
| 89 | +}]); |
| 90 | + |
| 91 | +// or on a route group |
| 92 | +app()->group('/protected', ['middleware' => 'auth.required', function () { |
| 93 | + app()->get('/route', function () { |
| 94 | + // this route is protected |
| 95 | + }); |
| 96 | +}]); |
| 97 | +``` |
| 98 | + |
| 99 | +If you use this method, the middleware will run before the route is executed. If the user is not logged in, the callback function you defined will be executed. This means you can remove the check for a logged in user from your route handler. |
| 100 | + |
| 101 | +```php |
| 102 | +app()->get('/protected', ['auth.required', function () { |
| 103 | + $user = auth()->user(); |
| 104 | + |
| 105 | + // no need to check if user is logged in |
| 106 | +}]); |
| 107 | +``` |
| 108 | + |
| 109 | +## Protected Guest Routes |
| 110 | + |
| 111 | +You can also protect routes that should only be accessible to guest users. This is useful for routes like the login and register routes. You can use the `auth.guest` middleware to protect these routes. |
| 112 | + |
| 113 | +```php |
| 114 | +auth()->middleware('auth.guest', function () { |
| 115 | + response()->redirect('/dashboard'); |
| 116 | +}); |
| 117 | +``` |
| 118 | + |
| 119 | +You can then use this middleware on your guest routes like this: |
| 120 | + |
| 121 | +```php |
| 122 | +app()->get('/login', ['middleware' => 'auth.guest', function () { |
| 123 | + // this route is only accessible to guest users |
| 124 | +}]); |
| 125 | +``` |
| 126 | + |
| 127 | +This middleware will run before the route is executed. If a user is logged in, the callback function you defined will be executed. This means you can remove the check for a guest user from your route handler. |
| 128 | + |
| 129 | +```php |
| 130 | +app()->get('/login', ['auth.guest', function () { |
| 131 | + // no need to check if the user is a guest |
| 132 | +}]); |
| 133 | +``` |
| 134 | + |
| 135 | +## Session Guards <Badge type="danger" text="DEPRECATED" /> |
| 136 | + |
| 137 | +The previous version of Leaf Auth had a feature called session guards. This feature has been deprecated in the latest version of Leaf Auth. If you were using session guards in your app, you can switch to the new middleware system to protect your routes. |
| 138 | + |
| 139 | +The middleware system is more flexible and allows you to define more complex authentication logic using the middleware callback functions. |
| 140 | + |
| 141 | +You can also use the middleware system to protect routes for both logged in and guest users, which is essentially what session guards were used for. |
0 commit comments