在Laravel中,如果已经在检查中间件,我应该在控制器中检查权限吗


In Laravel, should I check for permission in controller if already checking on middleware?

我创建了一个中间件,用于检查用户是否有权执行操作,并将该中间件添加到我想要保护的路由中,如下所示:

// VerifyPermission middleware
class VerifyPermission {
    /**
     * Handle an incoming request.
     *
     * @param  'Illuminate'Http'Request $request
     * @param  'Closure $next
     * @param $permission
     * @return mixed
     */
    public function handle($request, Closure $next, $permission)
    {
        $user = auth()->user();
        if (auth()->check() && $user->hasPermission($permission))
        {
            return $next($request);
        }
        return redirect('/');
    }
}
// Routes
Route::patch('company/{id}', ['as' => 'updateCompany',
                              'uses' => 'SettingsController@updateCompany',
                              'middleware' => 'permission:manage_company']
);

我的问题是,是否有必要对updateCompany进行另一次检查,或者中间件检查是否足够?

public function updateCompany()
{
    if(Auth::user()->hasPermission('manage_company'))
    {
        // Updates Company
    }   
    return abort(403, "Unauthorized");
}

不,你不应该再做一次检查,中间件会做的。

事实上,处理身份验证和权限处理是中间件最常见的用途之一

当您指定此项时:

Route::patch('company/{id}', ['as' => 'updateCompany',
                          'uses' => 'SettingsController@updateCompany',
                          'middleware' => 'permission:manage_company']

您告诉laravel,当它找到company/{id}路由时,它应该触发permission:manage_company中间件的handle方法,然后将请求发送到SettingsController

因此,当请求到达您的控制器时,您确信它已经满足了通过的所有中间件