Authorization (gates and policies) - Knowledge of Laravel

Authentication vs. authorization

Authentication verifies “who” a user is. Signing in is the canonical example. Authorization decides “what” that user is allowed to do. For example, you might let users edit only their own posts, or restrict configuration changes to administrators. Once you’ve implemented sign-in through authentication, authorization is your next step.

Laravel’s authorization features offer two approaches: gates and policies. Which to use depends on your use case.

How to choose

Scenario	Recommended
Simple checks not tied to a specific model	Gate
Managing CRUD permissions on a model	Policy
Restricting access to an admin dashboard	Gate
Permissions for creating, editing, and deleting blog posts	Policy

Gates

Gates are simple closure-based authorization checks. They’re well suited to permission checks that aren’t tied to a particular model.

Authorization flow with gates

Defining a gate

Define gates in the boot method of App\Providers\AppServiceProvider using Gate::define().

// app/Providers/AppServiceProvider.php

use App\Models\Post;
use App\Models\User;
use Illuminate\Support\Facades\Gate;

public function boot(): void
{
    Gate::define('update-post', function (User $user, Post $post) {
        return $user->id === $post->user_id;
    });
}

A gate closure always receives the currently authenticated user as its first argument. Additional information — such as the target model — can be passed as further arguments.

Checking permissions with a gate

To check permissions in a controller, use Gate::allows() or Gate::denies().

use Illuminate\Support\Facades\Gate;

public function update(Request $request, Post $post): RedirectResponse
{
    if (! Gate::allows('update-post', $post)) {
        abort(403);
    }

    // Update the post...

    return redirect('/posts');
}

Throwing exceptions with Gate::authorize()

Use Gate::authorize() to automatically return a 403 response when the user is unauthorized. You can skip the manual abort(403).

public function update(Request $request, Post $post): RedirectResponse
{
    Gate::authorize('update-post', $post);

    // Reached only when the user is authorized
    // Update the post...

    return redirect('/posts');
}

When unauthorized, Gate::authorize() throws Illuminate\Auth\Access\AuthorizationException. Laravel automatically converts it into a 403 HTTP response.

Administrator bypass (the before method)

To grant administrators every permission, use Gate::before().

use App\Models\User;
use Illuminate\Support\Facades\Gate;

public function boot(): void
{
    // $ability contains the name of the gate being checked (for example, 'update-post')
    Gate::before(function (User $user, string $ability) {
        if ($user->isAdministrator()) {
            return true;
        }
    });

    Gate::define('update-post', function (User $user, Post $post) {
        return $user->id === $post->user_id;
    });
}

If the before closure returns anything other than null, that result becomes the final permission decision. Returning null (or nothing) falls through to the normal gate check.

@can / @cannot in Blade templates

The @can and @cannot directives make it easy to run gate checks in your templates.

@can('update-post', $post)
    <a href="{{ route('posts.edit', $post) }}">Edit</a>
@endcan

@cannot('update-post', $post)
    <p>You don't have permission to edit this post.</p>
@endcannot

Policies

A policy is a class that groups authorization logic related to a particular model. For managing create, view, update, and delete permissions on a Post model, a policy is a better fit than a gate.

Authorization flow with a policy

Generating a policy

Use the make:policy Artisan command to generate a policy class.

php artisan make:policy PostPolicy

Use the --model option to scaffold a policy that includes every CRUD method for that model.

php artisan make:policy PostPolicy --model=Post

app/Policies/PostPolicy.php is generated.

Model and policy auto-discovery

By default, Laravel automatically discovers policies based on a naming convention.

Model: app/Models/Post.php
Policy: app/Policies/PostPolicy.php

As long as you follow the convention, you don’t need to register the policy yourself.

If you deviate from the naming convention or want to register a policy manually, use Gate::policy() in the boot method of AppServiceProvider.

use App\Models\Post;
use App\Policies\PostPolicy;
use Illuminate\Support\Facades\Gate;

Gate::policy(Post::class, PostPolicy::class);

In Laravel 13, you can also register a policy declaratively by attaching the #[UsePolicy] attribute to the model.

use App\Policies\PostPolicy;
use Illuminate\Database\Eloquent\Attributes\UsePolicy;

#[UsePolicy(PostPolicy::class)]
class Post extends Model {}

Implementing policy methods

A policy generated with the --model option includes methods that correspond to the standard CRUD actions.

<?php

namespace App\Policies;

use App\Models\Post;
use App\Models\User;

class PostPolicy
{
    /**
     * Whether the user may view the post list.
     */
    public function viewAny(User $user): bool
    {
        return true; // Any authenticated user may view
    }

    /**
     * Whether the user may view a specific post.
     */
    public function view(User $user, Post $post): bool
    {
        return true; // Any authenticated user may view
    }

    /**
     * Whether the user may create a post.
     */
    public function create(User $user): bool
    {
        return true; // Any authenticated user may create posts
    }

    /**
     * Whether the user may update a post.
     */
    public function update(User $user, Post $post): bool
    {
        return $user->id === $post->user_id; // Only the author may edit
    }

    /**
     * Whether the user may delete a post.
     */
    public function delete(User $user, Post $post): bool
    {
        return $user->id === $post->user_id; // Only the author may delete
    }
}

Administrator bypass (the before method)

Policies also support a before method that grants administrators every permission.

/**
 * A pre-check executed before any other policy method.
 * $ability contains the policy method name (for example, 'update' or 'delete').
 */
public function before(User $user, string $ability): bool|null
{
    if ($user->isAdministrator()) {
        return true; // Administrators are allowed every action
    }

    return null; // Returning null falls through to the normal policy method
}

The before method is invoked only when a matching method exists on the policy class. For example, if there is no update method, before is not called for update.

Order of before callbacks

Using policies from controllers

The authorize() method

Laravel controllers include an authorize() helper method (when you’re not extending the base controller, use Gate::authorize() instead).

Gate::authorize()
User::can() / cannot()

<?php

namespace App\Http\Controllers;

use App\Models\Post;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Gate;

class PostController extends Controller
{
    public function update(Request $request, Post $post): RedirectResponse
    {
        Gate::authorize('update', $post);

        // Update the post...

        return redirect()->route('posts.index');
    }

    public function store(Request $request): RedirectResponse
    {
        Gate::authorize('create', Post::class);

        // Create the post...

        return redirect()->route('posts.index');
    }

    public function destroy(Post $post): RedirectResponse
    {
        Gate::authorize('delete', $post);

        $post->delete();

        return redirect()->route('posts.index');
    }
}

<?php

namespace App\Http\Controllers;

use App\Models\Post;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;

class PostController extends Controller
{
    public function update(Request $request, Post $post): RedirectResponse
    {
        if ($request->user()->cannot('update', $post)) {
            abort(403);
        }

        // Update the post...

        return redirect()->route('posts.index');
    }
}

Registering RESTful policies in bulk with authorizeResource()

Calling authorizeResource() in the constructor automatically wires each controller action to the corresponding policy method.

<?php

namespace App\Http\Controllers;

use App\Models\Post;

class PostController extends Controller
{
    public function __construct()
    {
        $this->authorizeResource(Post::class, 'post');
    }

    // The corresponding policy method is applied automatically to
    // index(), show(), create(), store(), edit(), update(), and destroy()
}

Mapping between controller actions and policy methods:

Controller action	Policy method
`index`	`viewAny`
`show`	`view`
`create` / `store`	`create`
`edit` / `update`	`update`
`destroy`	`delete`

With authorizeResource(), you no longer need to write an individual authorize() call in each action. It’s especially convenient when paired with RESTful resource controllers.

Authorization via middleware

To perform authorization at the route level, use the can middleware.

use App\Models\Post;

// Accessible only to users authorized to update the post
Route::put('/posts/{post}', [PostController::class, 'update'])
    ->middleware('can:update,post');

// Accessible only to users authorized to create posts
Route::post('/posts', [PostController::class, 'store'])
    ->middleware('can:create,App\Models\Post');

A shorter form with the can method:

Route::put('/posts/{post}', [PostController::class, 'update'])
    ->can('update', 'post');

Using policies in Blade templates

Once a policy is registered, Blade’s @can / @cannot directives automatically use it.

{{-- Show the edit button only to authorized users --}}
@can('update', $post)
    <a href="{{ route('posts.edit', $post) }}" class="btn">Edit</a>
@endcan

{{-- Same idea for the delete button --}}
@can('delete', $post)
    <form method="POST" action="{{ route('posts.destroy', $post) }}">
        @csrf
        @method('DELETE')
        <button type="submit">Delete</button>
    </form>
@endcan

{{-- New post button --}}
@can('create', App\Models\Post::class)
    <a href="{{ route('posts.create') }}">New post</a>
@endcan

Practical example: managing blog post permissions

Here’s how to implement “only the author can edit or delete their own posts” in a blog application.

Generate the policy

php artisan make:policy PostPolicy --model=Post

Implement the policy methods

<?php

namespace App\Policies;

use App\Models\Post;
use App\Models\User;

class PostPolicy
{
    /**
     * Grant administrators every permission.
     */
    public function before(User $user, string $ability): bool|null
    {
        if ($user->is_admin) {
            return true;
        }

        return null;
    }

    public function viewAny(User $user): bool
    {
        return true;
    }

    public function view(User $user, Post $post): bool
    {
        return true;
    }

    public function create(User $user): bool
    {
        return true;
    }

    public function update(User $user, Post $post): bool
    {
        return $user->id === $post->user_id;
    }

    public function delete(User $user, Post $post): bool
    {
        return $user->id === $post->user_id;
    }
}

Add authorizeResource() to the controller

<?php

namespace App\Http\Controllers;

use App\Models\Post;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\View\View;

class PostController extends Controller
{
    public function __construct()
    {
        $this->authorizeResource(Post::class, 'post');
    }

    public function index(): View
    {
        $posts = Post::latest()->paginate(10);
        return view('posts.index', compact('posts'));
    }

    public function store(Request $request): RedirectResponse
    {
        $post = $request->user()->posts()->create(
            $request->validate([
                'title' => ['required', 'string', 'max:255'],
                'body'  => ['required', 'string'],
            ])
        );

        return redirect()->route('posts.show', $post);
    }

    public function update(Request $request, Post $post): RedirectResponse
    {
        $post->update(
            $request->validate([
                'title' => ['required', 'string', 'max:255'],
                'body'  => ['required', 'string'],
            ])
        );

        return redirect()->route('posts.show', $post);
    }

    public function destroy(Post $post): RedirectResponse
    {
        $post->delete();

        return redirect()->route('posts.index');
    }
}

Add permission checks to Blade templates

{{-- resources/views/posts/show.blade.php --}}
<h1>{{ $post->title }}</h1>
<p>{{ $post->body }}</p>
<p>Author: {{ $post->user->name }}</p>

@can('update', $post)
    <a href="{{ route('posts.edit', $post) }}">Edit</a>
@endcan

@can('delete', $post)
    <form method="POST" action="{{ route('posts.destroy', $post) }}">
        @csrf
        @method('DELETE')
        <button type="submit">Delete</button>
    </form>
@endcan

Summary

Choosing between gates and policies

Gates: simple permission checks that aren’t tied to a model — such as access to an admin dashboard or permission to change global settings.
Policies: managing CRUD permissions for a model. Create a policy class for each resource such as Post, Order, or Comment.

Common APIs

// Check with a gate
Gate::allows('update-post', $post);      // true/false
Gate::denies('update-post', $post);      // true/false
Gate::authorize('update-post', $post);   // throws on failure

// Check on the user model
$user->can('update', $post);     // true/false
$user->cannot('update', $post);  // true/false

// Check in a controller
Gate::authorize('update', $post);        // 403 on failure

// Check in Blade
@can('update', $post) ... @endcan
@cannot('update', $post) ... @endcannot

Common Artisan commands

# Generate an empty policy
php artisan make:policy PostPolicy

# Generate a policy with CRUD methods for the model
php artisan make:policy PostPolicy --model=Post

​Authentication vs. authorization

​Gates

​Authorization flow with gates

​Defining a gate

​Checking permissions with a gate

​Throwing exceptions with Gate::authorize()

​Administrator bypass (the before method)

​@can / @cannot in Blade templates

​Policies

​Authorization flow with a policy

​Generating a policy

​Model and policy auto-discovery

​Implementing policy methods

​Administrator bypass (the before method)

​Order of before callbacks

​Using policies from controllers

​The authorize() method

​Registering RESTful policies in bulk with authorizeResource()

​Authorization via middleware

​Using policies in Blade templates

​Practical example: managing blog post permissions

​Summary

Authentication vs. authorization

Gates

Authorization flow with gates

Defining a gate

Checking permissions with a gate

Throwing exceptions with Gate::authorize()

Administrator bypass (the before method)

@can / @cannot in Blade templates

Policies

Authorization flow with a policy

Generating a policy

Model and policy auto-discovery

Implementing policy methods

Administrator bypass (the before method)

Order of before callbacks

Using policies from controllers

The authorize() method

Registering RESTful policies in bulk with authorizeResource()

Authorization via middleware

Using policies in Blade templates

Practical example: managing blog post permissions

Summary