OMNI Access
v1.3.0
Free
~10 min read
Protecting Routes with Middleware
Guard routes with role, permission, and role-or-permission middleware, including parameter syntax and combined protection patterns.
01
Step 1 of 4
Available Middleware
role- Check if user has specific role(s)permission- Check if user has specific permission(s)role_or_permission- Check if user has role OR permission
02
Step 2 of 4
Role Middleware
// Single role
Route::middleware(['auth', 'role:admin'])->group(function () {
Route::get('/admin', [AdminController::class, 'index']);
});
// Multiple roles (user must have at least one)
Route::middleware('role:admin,editor')->group(function () {
Route::resource('posts', PostController::class);
});
// In controller
public function __construct()
{
$this->middleware('role:admin')->except(['index', 'show']);
}
// Single role
Route::middleware(['auth', 'role:admin'])->group(function () {
Route::get('/admin', [AdminController::class, 'index']);
});
// Multiple roles (user must have at least one)
Route::middleware('role:admin,editor')->group(function () {
Route::resource('posts', PostController::class);
});
// In controller
public function __construct()
{
$this->middleware('role:admin')->except(['index', 'show']);
}
03
Step 3 of 4
Permission Middleware
// Single permission
Route::middleware(['auth', 'permission:posts.edit'])->group(function () {
Route::get('/posts/{post}/edit', [PostController::class, 'edit']);
});
// Multiple permissions
Route::middleware('permission:posts.edit,posts.delete')->group(function () {
Route::put('/posts/{post}', [PostController::class, 'update']);
Route::delete('/posts/{post}', [PostController::class, 'destroy']);
});
// Single permission
Route::middleware(['auth', 'permission:posts.edit'])->group(function () {
Route::get('/posts/{post}/edit', [PostController::class, 'edit']);
});
// Multiple permissions
Route::middleware('permission:posts.edit,posts.delete')->group(function () {
Route::put('/posts/{post}', [PostController::class, 'update']);
Route::delete('/posts/{post}', [PostController::class, 'destroy']);
});
04
Step 4 of 4
Role OR Permission Middleware
// User needs either admin role OR posts.manage permission
Route::middleware('role_or_permission:admin,posts.manage')->group(function () {
Route::resource('posts', PostController::class);
});
// Multiple checks
Route::middleware('role_or_permission:admin,editor,posts.publish')
->post('/posts/{post}/publish', [PostController::class, 'publish']);
PRO Feature: Advanced middleware like geo-restrictions, time-based permissions, and IP restrictions are available in PRO. Learn more → (
#comparison)
// User needs either admin role OR posts.manage permission
Route::middleware('role_or_permission:admin,posts.manage')->group(function () {
Route::resource('posts', PostController::class);
});
// Multiple checks
Route::middleware('role_or_permission:admin,editor,posts.publish')
->post('/posts/{post}/publish', [PostController::class, 'publish']);Community Discussions 0
Ask questions, share step solutions, or discuss software workflows with other professionals.
Moderated Community
Join the Community Discussion
Got stuck on a step or have a question about this configuration? Sign in to join the discussion and receive direct advice from instructors and peers.
Guide Checklist
4 Steps
Tutorial Progress
0%
No Discussions Yet
Have a question or found a clever tip for this guide? Start the conversation using the comment box above!