Mastering Authorization in Laravel: Gates and Policies

Read Time:3 Minute, 9 Second

When building a Laravel application, ensuring that users have the appropriate access to resources is crucial. Laravel provides robust tools for handling authorization with Gates and Policies. In this blog post, we’ll explore what Gates and Policies are, how they differ, and how to use them effectively in your Laravel projects.

What Are Gates and Policies?

Both Gates and Policies are part of Laravel’s authorization system, designed to manage user permissions in a clean and organized manner.

Gates provide a simple, closure-based way to perform authorization checks. They are typically used for straightforward authorization logic, such as checking if a user can perform a specific action.

Policies, on the other hand, offer a more structured approach. They are tied to specific models and allow you to define a set of methods for different actions (like creating, updating, or deleting resources) related to that model.

When to Use Gates vs. Policies

Use Gates when you need to perform simple authorization checks that don’t directly relate to a model. For instance, if you need to verify if a user has the permission to access a particular feature or perform a specific action, Gates are a good choice.
Use Policies when you have complex authorization logic that is tied to a specific model. Policies are ideal when you need to define and manage permissions related to actions on a resource, such as posts, comments, or any other model in your application.

Implementing Gates

Step 1: Define a Gate

Gates are defined in the AuthServiceProvider class. Here’s an example of how to define a Gate to check if a user can update a post:

// app/Providers/AuthServiceProvider.php

use Illuminate\Support\Facades\Gate;

public function boot()
{
    $this->registerPolicies();

    Gate::define('update-post', function ($user, $post) {
        return $user->id === $post->user_id;
    });
}

Step 2: Use the Gate

You can check authorization in your controllers or views using the Gate facade:

// In a controller method
if (Gate::allows('update-post', $post)) {
    // The current user can update the post
} else {
    // The user cannot update the post
}

In a Blade view, you can use the @can directive:

@can('update-post', $post)
    <!-- The current user can update the post -->
@endcan

Implementing Policies

Step 1: Create a Policy

Use the Artisan command to create a policy:

php artisan make:policy PostPolicy

This will generate a policy class in the app/Policies directory. Define the methods in your policy class:

// app/Policies/PostPolicy.php

namespace App\Policies;

use App\Models\Post;
use App\Models\User;

class PostPolicy
{
    public function update(User $user, Post $post)
    {
        return $user->id === $post->user_id;
    }

    // You can define other methods like 'view', 'delete', etc.
}

Step 2: Register the Policy

// app/Providers/AuthServiceProvider.php

use App\Models\Post;
use App\Policies\PostPolicy;

protected $policies = [
    Post::class => PostPolicy::class,
];

Step 3: Use the Policy

You can check permissions using the can method on a user instance:

// In a controller method
if ($user->can('update', $post)) {
    // The user can update the post
} else {
    // The user cannot update the post
}

In Blade views, use the @can directive similarly:

@can('update', $post)
    <!-- The user can update the post -->
@endcan

Summary

Gates and Policies are powerful tools in Laravel that help you manage user permissions efficiently. Gates are great for simple checks, while Policies provide a structured approach to handle complex authorization logic related to models. By leveraging these tools, you can ensure that your application’s access control is both flexible and secure.

https://laravel.com/docs/11.x/authorization#gates