CODEWITHSUNDEEP
laravellaravel-5
fightstarr20
fightstarr20

Reputation: 12568

Laravel - Prevent non admin users from accessing the dashboard

I am preventing users who do not have a role of 'admin' from logging in to the dashboard in a Laravel 5.5 app like this in app/http/Controllers/auth/LoginController.php..

   protected function credentials(\Illuminate\Http\Request $request)
    {
        $credentials = $request->only($this->username(), 'password');

        return array_add($credentials, 'type', 'admin');
    }

This works well, but if somebody resets their password using the forgotten password function then it bypasses this function and lets them in to the dashboard.

How can I lock the dashboard down to prevent this happening?

Should I disable auto login after password reset, will this be enough?

Upvotes: 0

Views: 1944

Answers (2)

Moayad
Moayad

Reputation: 21

Use Middleware, you will have full control on all requests in your app.

Also, you might want to have a look at (spatie/laravel-permission) @ github it will make your Role/Permission process really easier.

Upvotes: 2

PSA
PSA

Reputation: 361

Overwrite the authenticated method in LoginController. Place the code below in the LoginController.

protected function authenticated(Request $request, $user)
{
    if ( Use your Logic here ) {
        return redirect()->route('admin.home');
    }

    return redirect('/home');
}

Upvotes: 1

Related Questions