Close the Gate! Using Laravel's Authorization Layer
summary
Describes how Laravel Gates and Policies actually get wired: defining abilities, policy methods, middleware and Blade can/cannot, and the controller authorized helper that auto-throws on denial. Shows a simple database-backed permissions mapping, warns about caching and N+1 queries, and explains super-admin handling via the before hook returns null to continue and optional after hook for overrides. Recommends packages including Spatie laravel-permissions with 3.25 million downloads and lab404/laravel-impersonate, and notes real-world usage like Zen Cart running 100,000 stores.
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:27The Problem: What I Needed
- 2:41Objectives
- 3:10Auth != Auth
- 4:33Authorization in Laravel
- 6:02Gate::define
- 8:45Policy Methods (return:boolean)
- 9:47Controller: Sthis- authorize()
- 11:14Policy Method with extra context
- 12:24Blade: @can family
- 16:38Storing Dynamic Permissions in the Database
- 17:44Registering Permissions from the Database
- 18:44Validation in Form Requests
- 19:28Front-End Clients
- 20:16Best-Practices
- 21:34When To Use Packages
- 22:40Popular ACL Packages
- 24:45Review
related talks
01h 07mGetting Authorization Right in .NET: Patterns, Pitfalls...
01h 46mAuthentication & Authorization
41mAccess Denied: the missing guide to authorization in Rails
48mLaravel Authentication Deep Dive
26mThink Like an Adversary: OPSEC for Laravel Developers
59mEasily Digestible Security Pills
54mAuthorization for modern Applications
27mAuthorization in the GraphQL era