How to use 'OR' middleware for laravel 5 route

Question

I have two types for the user, and I created several intermediaries.

In some routes it is necessary to allow the use of both types of users.

I am trying to make the following code:

Route::group(['namespace' => 'Common', 'middleware' => ['Auth1', 'Auth2']], function() { Route::get('viewdetail', array('as' => 'viewdetail', 'uses' => ' DashboardController@viewdetail ')); }); 

But its not working :(

Answer 1

Middleware should either return a response or pipe a request. Middlewares are independent of each other and should not know about the passage of other intermediaries.

You will need to implement a separate middleware that allows you to perform 2 roles or one middleware that accepts the allowed roles as parameters.

Option 1 : just create middleware - this is a combined version of Auth1 and Auth2 that checks for two types of users. This is the easiest option, although not very flexible.

Option 2 : since version 5.1 middlewares can take parameters - see the details here: https://laravel.com/docs/5.1/middleware#middleware-parameters . You could implement one middleware that would display a list of user roles to verify and simply identify the allowed roles in the routes file. The following code should do the trick:

 // define allowed roles in your routes.php Route::group(['namespace' => 'Common', 'middleware' => 'checkUserRoles:role1,role2', function() { //routes that should be allowed for users with role1 OR role2 go here }); // PHP < 5.6 // create a parametrized middleware that takes allowed roles as parameters public function handle($request, Closure $next) { // will contain ['role1', 'role2'] $allowedRoles = array_slice(func_get_args(), 2); // do whatever role check logic you need } // PHP >= 5.6 // create a parametrized middleware that takes allowed roles as parameters public function handle($request, Closure $next, ...$roles) { // $roles will contain ['role1', 'role2'] // do whatever role check logic you need } 

Answer 2

In this example, How to pass a few parameters to middleware with an OR clause in Laravel 5.2

Instead of adding a few arguments to your descriptor method and having to update it every time you add a new role to the application, you can make it dynamic.

Middleware

  /** * Handle an incoming request. * * @param $request * @param Closure $next * @return \Illuminate\Http\RedirectResponse|\Illuminate\Routing\Redirector */ public function handle($request, Closure $next) { $roles = array_slice(func_get_args(), 2); // [default, admin, manager] foreach ($roles as $role) { try { Role::whereName($role)->firstOrFail(); // make sure we got a "real" role if (Auth::user()->hasRole($role)) { return $next($request); } } catch (ModelNotFoundException $exception) { dd('Could not find role ' . $role); } } Flash::warning('Access Denied', 'You are not authorized to view that content.'); // custom flash class return redirect('/'); } 

Route

 Route::group(['middleware' => ['role_check:default,admin,manager']], function() { Route::get('/user/{user_id}', array('uses' => ' UserController@showUserDashboard ', 'as' => 'showUserDashboard')); }); 

This will check if the authenticated user has at least one of the roles provided, and if so, passes the request to the next middleware stack. Of course, the hasRole() method and the roles themselves must be implemented by you.

You can use php 5.6

 public function handle($request, Closure $next, ...$roles) { foreach ($roles as $role) { try { if ($request->user()->can($role)) { return $next($request); } } catch (ModelNotFoundException $exception) { abort(403); } } }