Insights into Company
← PHP & Laravel

Roles, Middleware and Policies

Understand the idea. Compare it. Explain it. Test yourself.

Question 1 of 7

How do you model Admin, Compliance, Recruiter and Sales Director roles?

Practice question · write your own answer
  • Define the concept in one or two sentences.
  • Give a small example and trace what happens.
  • Explain one limitation, trade-off, or common mistake.
Practice explaining this
Question 2 of 7

How does route middleware enforce a role?

Solution and explanation

  • Middleware filters HTTP requests before they reach the controller and can also process the response afterwards.
class CheckAdmin
{
    public function handle(Request $request, Closure $next)
    {
        if (! $request->user()?->is_admin) {
            abort(403);
        }

        return $next($request);
    }
}
Request → Middleware → Controller → Response → Middleware → Browser
  • Common middleware: auth, guest, verified, throttle and CSRF verification.
Practice explaining this
Question 3 of 7

Authentication versus authorization?

Solution and explanation

  • Middleware generally controls whether a request should proceed at all.
  • Authorization decides whether a user may perform a particular action on a particular resource.
  • Middleware asks: is the user authenticated?
  • Authorization asks: can this authenticated user delete this invoice?
$this->authorize('delete', $invoice);
  • This normally uses a Policy (InvoicePolicy::delete).
  • Use middleware for broad route rules and policies for record-level decisions.
Practice explaining this
Question 4 of 7

When should you use a policy instead of middleware?

Solution and explanation

  • Middleware generally controls whether a request should proceed at all.
  • Authorization decides whether a user may perform a particular action on a particular resource.
  • Middleware asks: is the user authenticated?
  • Authorization asks: can this authenticated user delete this invoice?
$this->authorize('delete', $invoice);
  • This normally uses a Policy (InvoicePolicy::delete).
  • Use middleware for broad route rules and policies for record-level decisions.
Practice explaining this
Question 5 of 7

How do gates and policies work?

Practice question · write your own answer
  • Define the concept in one or two sentences.
  • Give a small example and trace what happens.
  • Explain one limitation, trade-off, or common mistake.
Practice explaining this
Question 6 of 7

How do you show role-specific Blade controls safely?

Practice question · write your own answer
  • Define the concept in one or two sentences.
  • Give a small example and trace what happens.
  • Explain one limitation, trade-off, or common mistake.
Practice explaining this
Question 7 of 7

What is least-privilege authorization?

Practice question · write your own answer
  • Define the concept in one or two sentences.
  • Give a small example and trace what happens.
  • Explain one limitation, trade-off, or common mistake.
Practice explaining this