如何使用laravel 5.2无需方法检查方法来管理基于访问的角色用户

Question

My actual project needs to implement an ACL for the diferent roles in my users.

For now, I have like 4 roles defined by the client (Administrator, Head of Departament, Secretary and Teachers) but he wants to create more roles whenever he needs it.

Knowing this the clue is I want to know if is there any way to control the system access without checking the access in each method of my system. Laravel provides my the Authorization services but is not enough for the desing of my system, but I think is a deprecated way checking every method.

My idea is implement something before enrouting any request and check if the user has access depending on his roles, in this way I won't need to check it in every method as the actual solution that laravel Authorization services, laravel-acl of Kodeine or similars offers me.

If someone has an idea to set forth this Idea please answer this.

Also I want to know if this could affect the system security and how and how I can handle that.

Thanks in advance.

Answer 1

If you want to use role-base access control only, it's very easy to create own middleware where you check passed roles. Now in your routes you can protect routes depending on user roles, for example:

Route::group(['middleware' => 'authorize:admin,secretary'], function() {
   // your route here
});

You have sample role middleware in Laravel documentation here.