Authentication guards in Laravel - Mini Project: Build & Apply

Authentication Guards in Laravel

📖 Scenario: You are building a simple Laravel web app that has two types of users: admins and customers. You want to protect certain pages so only admins can access them, and other pages so only customers can access them.This is like having two different keys for two different rooms in a house. Each key only opens its own room.

🎯 Goal: Build a Laravel app that uses authentication guards to restrict access to routes based on user type.You will create two guards: one for admins and one for customers, then protect routes accordingly.

📋 What You'll Learn

Create a users array with admin and customer users

Define two guards: admin and customer

Use middleware to protect routes based on guards

Create routes that only admins or customers can access

💡 Why This Matters

🌍 Real World

Many web apps have different user roles needing separate login and access control. Authentication guards help manage this cleanly.

💼 Career

Understanding Laravel authentication guards is essential for backend developers working on secure multi-role applications.

1

Create users array with admin and customer roles

Create a PHP array called users with two entries: one with 'username' => 'adminUser' and 'role' => 'admin', and another with 'username' => 'customerUser' and 'role' => 'customer'.

Laravel

<?php

// Create users array with admin and customer
# Your code here

Hint

Use a PHP array with two associative arrays inside, each with keys username and role.

2

Define admin and customer guards in config/auth.php

In the config/auth.php file, add two guards inside the 'guards' array: one named 'admin' using 'session' driver and 'admins' provider, and another named 'customer' using 'session' driver and 'customers' provider.

Laravel

 'adminUser', 'role' => 'admin'],
    ['username' => 'customerUser', 'role' => 'customer'],
];

return [
    'guards' => [
        // Add admin and customer guards here
        # Your code here
    ],
    'providers' => [
        // existing providers
    ],
];

Hint

Inside the 'guards' array, add two arrays with keys driver and provider for each guard.

3

Protect routes using admin and customer middleware

In the routes/web.php file, create two routes: /admin/dashboard protected by 'auth:admin' middleware, and /customer/profile protected by 'auth:customer' middleware. Each route should return a simple string like 'Admin Dashboard' or 'Customer Profile'.

Laravel

 'adminUser', 'role' => 'admin'],
    ['username' => 'customerUser', 'role' => 'customer'],
];

return [
    'guards' => [
        'admin' => [
            'driver' => 'session',
            'provider' => 'admins',
        ],
        'customer' => [
            'driver' => 'session',
            'provider' => 'customers',
        ],
    ],
    'providers' => [
        // existing providers
    ],
];

// routes/web.php

use Illuminate\Support\Facades\Route;

// Add routes with auth middleware here
# Your code here

Hint

Use Route::get with a closure returning a string, and add ->middleware('auth:admin') or ->middleware('auth:customer').

4

Complete providers for admins and customers

In the config/auth.php file, add two providers inside the 'providers' array: one named 'admins' using 'eloquent' driver and App\Models\Admin::class as model, and another named 'customers' using 'eloquent' driver and App\Models\Customer::class as model.

Laravel

 'adminUser', 'role' => 'admin'],
    ['username' => 'customerUser', 'role' => 'customer'],
];

return [
    'guards' => [
        'admin' => [
            'driver' => 'session',
            'provider' => 'admins',
        ],
        'customer' => [
            'driver' => 'session',
            'provider' => 'customers',
        ],
    ],
    'providers' => [
        // Add admins and customers providers here
        # Your code here
    ],
];

// routes/web.php

use Illuminate\Support\Facades\Route;

Route::get('/admin/dashboard', function () {
    return 'Admin Dashboard';
})->middleware('auth:admin');

Route::get('/customer/profile', function () {
    return 'Customer Profile';
})->middleware('auth:customer');

Hint

Inside 'providers', add two arrays with keys driver and model for admins and customers.

Practice

1. What is the main purpose of an authentication guard in Laravel?

easy

A. To manage session timeouts

B. To store user passwords securely

C. To define database connections

D. To control how users are authenticated for each request

Solution

1. Step 1: Understand the role of authentication guards

   Guards determine how users are authenticated on each request, like checking credentials or tokens.

2. Step 2: Differentiate guards from other features

   Guards do not store passwords, manage sessions, or define databases; those are handled elsewhere.

3. Final Answer:

   To control how users are authenticated for each request -> Option D

4. Quick Check:

   Authentication guard = controls user authentication [OK]

Hint: Guards decide how users log in and access app [OK]

Common Mistakes:

• Confusing guards with password storage
• Thinking guards manage database connections
• Assuming guards handle session timeouts

2. Which of the following is the correct way to specify a guard in Laravel's auth.php config file?

easy

A. 'guards' => ['web' => ['driver' => 'database', 'provider' => 'users']]

B. 'guards' => ['web' => ['driver' => 'token', 'provider' => 'admins']]

C. 'guards' => ['web' => ['driver' => 'session', 'provider' => 'users']]

D. 'guards' => ['api' => ['driver' => 'session', 'provider' => 'users']]

Solution

1. Step 1: Check the standard guard configuration

   Laravel's default 'web' guard uses 'session' driver and 'users' provider.

2. Step 2: Validate driver and provider correctness

   'database' is not a valid driver for guards; 'token' is used for API guards, but 'web' uses 'session'.

3. Final Answer:

   'guards' => ['web' => ['driver' => 'session', 'provider' => 'users']] -> Option C

4. Quick Check:

   Default web guard uses session driver [OK]

Hint: Web guard uses session driver and users provider [OK]

Common Mistakes:

• Using 'database' as a driver instead of 'session'
• Mixing 'token' driver with 'web' guard
• Assigning wrong provider names

3. Given this code snippet in a Laravel controller:

if (Auth::guard('admin')->check()) {
    return 'Admin logged in';
} else {
    return 'No admin logged in';
}

What will be the output if no admin user is logged in but a regular user is?

medium

A. No admin logged in

B. Error: guard not found

C. Admin logged in

D. No output

Solution

1. Step 1: Understand what Auth::guard('admin')->check() does

   This checks if a user is logged in using the 'admin' guard specifically.

2. Step 2: Analyze the scenario

   No admin user is logged in, so check() returns false, even if a regular user is logged in under a different guard.

3. Final Answer:

   No admin logged in -> Option A

4. Quick Check:

   Guard check false means no user logged in for that guard [OK]

Hint: Guard check only sees users of that guard [OK]

Common Mistakes:

• Assuming any logged-in user passes the guard check
• Confusing guard names
• Expecting error if guard exists

4. Identify the error in this Laravel guard usage:

Auth::guard('web')->login($user);
if (Auth::check()) {
    return 'User logged in';
}

medium

A. No error, code works correctly

B. Auth::check() does not check the 'web' guard by default

C. Missing middleware to protect the route

D. Auth::guard('web')->login() requires a user ID, not a user object

Solution

1. Step 1: Understand Auth::guard('web')->login()

   This logs in the user using the 'web' guard explicitly.

2. Step 2: Check what Auth::check() does

   Auth::check() uses the default guard, which may not be 'web', so it might not detect the login.

3. Final Answer:

   Auth::check() does not check the 'web' guard by default -> Option B

4. Quick Check:

   Auth::check() uses default guard, not necessarily 'web' [OK]

Hint: Auth::check() uses default guard, not specified guard [OK]

Common Mistakes:

• Assuming Auth::check() checks all guards
• Thinking login() needs user ID only
• Ignoring middleware importance

5. You want to protect an admin route so only users authenticated with the 'admin' guard can access it. Which is the correct way to apply this in Laravel's route definition?

hard

A. Route::middleware('auth:admin')->group(function () { Route::get('/admin', fn() => 'Admin area'); });

B. Route::middleware('auth:web')->group(function () { Route::get('/admin', fn() => 'Admin area'); });

C. Route::middleware('guest:admin')->group(function () { Route::get('/admin', fn() => 'Admin area'); });

D. Route::middleware('auth')->group(function () { Route::get('/admin', fn() => 'Admin area'); });

Solution

1. Step 1: Understand middleware usage for guards

   The 'auth' middleware accepts a guard name to specify which guard to check for authentication.

2. Step 2: Choose the middleware that checks 'admin' guard

   'auth:admin' ensures only users authenticated with 'admin' guard access the route.

3. Step 3: Eliminate incorrect options

   'auth:web' checks the wrong guard, 'guest:admin' checks for unauthenticated users, and 'auth' without guard uses default guard.

4. Final Answer:

   Route::middleware('auth:admin')->group(function () { Route::get('/admin', fn() => 'Admin area'); }); -> Option A

5. Quick Check:

   Use 'auth:guardname' middleware to protect routes [OK]

Hint: Use 'auth:admin' middleware to protect admin routes [OK]

Common Mistakes:

• Using 'auth' without specifying guard
• Using 'guest' middleware instead of 'auth'
• Applying wrong guard name in middleware