Authorization in Laravel: Can You Do That?

There's another "auth" that Laravel makes incredibly easy out of the box: authorization. But just how is authentication and authorization different?

Let's take a look at Gates and Policies, when to use one over the other, and the basics of how you can check if a user is authorized to do something anywhere in your application.

**clarification: while you can use $this authorize() in a Livewire class, you will need to use Gate authorize() in a controller in Laravel 11

*note: there's a LOT of awesome helper functions and ways to check gates and policies that we didn't talk about. The docs are a great place to dive deeper.

I really love how we can say "actually there is something for that in Laravel" for almost anything a modern Web application needs. I'm using Laravel since version 3 and love every minute spent using it. Thank you all the developers and users making it better each day <3

[reactoranime]

Would be nice to see some demos with: multiple user roles and separate role capabilities, and as an extra custom user capabilities. This definetely requires some tables like roles, capabilities and role_capabilities and user_capabilities.. but would be nice to see such implementation

[Lopoi]

Sometimes it`s nice to see a video like this to remind me of features of laravel that I forget exist

[sandeepbhambre]

I think In laravel 11 projects, $this->authorize() would not work by default because the base controller doesn't have supporting traits.

[ifeanyinnaemego]

Thanks this will help me decide how to manage my admin

[ifeanyinnaemego]

I hope am making the best career choice by sticking with Laravel

[sigmund]

What's your opinion on using something like spatie/laravel-permission? It is my go to since I prefer role/permissions than Gates or Policies

[shubhamsahuSD]

I am starting to like yours this type of videos ❤

[EMMA-zz]

Can the future of laravel compete with NodeJS and .NET

[safalpiya]

Thanks for the great content! By the way I'm using laravel as API with a React SPA without Inertia. What would be a good way to check if a user is authorized to do something inside the react app similar to @can('alert-users' ) directive inside blade files?

[Pekzr]

I don't think you got the the initial explanation of authentication vs authorisation right.
In that example authentication would be something like showing your ID to prove that you are you and maybe that you are the actual ticket holder if the tickets are personal. The ticket is authorisation and allows you to enter the venue as well as the specific areas.
Great video otherwise.

[dev]

Only 3 of these are correct. Find out which.

[АндрейГалушко-ео]

Зачем ему кепка нужна?
ну ладно очки, это понятно, возможно проблема со зрением, но зачем ему кепка?..