Laravel route middleware: protect pages and control access

Who this is for: Laravel beginners who can read a route declaration and want to understand how middleware gates requests.

What you will learn: how middleware differs from controller logic, how this project groups protected routes, how to inspect a route's middleware, and why authentication is not the same as role-based authorization.

Prerequisites: Familiarity with HTTP routes, controllers, and Laravel's session-based login.

Tested environment: Laravel Framework 13.16.1 and PHP 8.4.15. Examples follow TeachyLeaf's current route configuration; recheck route output when project middleware changes.

Middleware runs around a request

Middleware can inspect a request before it reaches its route action and can affect the response on the way back. Authentication middleware checks whether a user is signed in. Guest middleware is intended for routes that should be used by signed-out visitors, such as a login form.

Middleware is a request gate, not a replacement for validation, safe controller logic, or authorization policies. Each route should have the checks appropriate to the action it performs.

TeachyLeaf groups protected admin routes

The routes in routes/web.php place admin actions inside an authentication group:

Route::middleware('auth')->group(function () {
    Route::get('/change-version', [AssetVersionController::class, 'edit'])
        ->name('assets.version.edit');

    Route::post('/change-version', [AssetVersionController::class, 'update'])
        ->name('assets.version.update');
});

A signed-out visitor requesting the asset-version page is redirected to the configured admin login URL. An authenticated visitor may reach the controller action. The same kind of group protects the admin dashboard and management routes, while login and forgot-password pages are in a guest group.

The admin login form being protected by guest middleware does not secure the admin dashboard by itself: it is the separate auth middleware on the dashboard and protected actions that enforces sign-in.

Inspect the route instead of guessing

Artisan can show the registered method, URI, route name, action, and middleware. For example:

php artisan route:list --path=change-version -vv
php artisan route:list --path=admin/tutorials -vv

Check both the page's GET route and any POST, PUT, or DELETE route that changes data. Protecting a page form while leaving its write action public would not provide the intended access boundary.

Authentication is not role authorization

Authentication answers, “Who is signed in?” Authorization answers, “May this signed-in user perform this action?” TeachyLeaf currently groups admin operations behind Laravel's auth middleware but does not define separate admin roles or per-action policies in these routes. The group therefore does not prove that a particular user has a special role.

If an application needs multiple account types, implement and test the authorization rule explicitly—for example with policies, gates, or a carefully maintained role system. Do not treat a hidden link or an admin-looking URL as an access control.

Guest redirects and password recovery

TeachyLeaf's guest middleware redirects signed-in users to the admin dashboard. The forgot-password POST route also has a request throttle, and its response avoids saying whether a submitted email belongs to an account. Those checks address different concerns: guest middleware controls who sees the guest-only form, throttling limits request frequency, and the password broker validates reset tokens.

A redirect is not proof that the original request succeeded. Follow the response status and location, then test the destination separately. Automated route tests can verify middleware registration and response behavior, but they do not prove that a production mail provider delivers password-reset messages.

Practice: trace a signed-out request

A signed-out visitor opens GET /change-version. Which middleware should you inspect, and what should you expect this application to do?

References

• Laravel 13 middleware
• Laravel 13 authentication
• Laravel 13 authorization