Laravel authorization system ngontrol apa sing diidinine pengguna sing wis authenticated kanggo nindakake (beda karo authentication — sapa dheweke). Gates yaiku closure sederhana kanggo permissions; Policies yaiku class sing ngorganisir logic authorization ing sekitar model spesifik (contone sapa bisa nganyari Post).
Gates — permissions sederhana, adhedhasar closure
// define a gate (e.g. in a service provider)
Gate::define('edit-settings', fn($user) => $user->isAdmin());
// check it
if (Gate::allows('edit-settings')) { ... }
Gate::authorize('edit-settings'); // throws a 403 if denied
Gates apik kanggo permissions sederhana, standalone sing ora kaitan karo model spesifik.
Policies — authorization fokus model (kasus umum)
<?php
// php artisan make:policy PostPolicy --model=Post
class PostPolicy {
public function update(User $user, Post $post): bool {
return $user->id === $post->user_id; // only the author can update
}
public function delete(User $user, Post $post): bool {
return $user->id === $post->user_id || $user->isAdmin();
}
}
Class Policy ngumpulake rules authorization kanggo model — saben method mangsuli "apa pengguna iki bisa nindakake action iki ing model iki?" Iki njaga logic authorization tetep terorganisir per resource.
Nggunakake policies
// in a controller
public function update(Request $request, Post $post) {
$this->authorize('update', $post); // checks PostPolicy::update — throws 403 if denied
// ... proceed (we know the user is authorized)
}
// the user model
if ($request->user()->can('update', $post)) { ... }
{{-- in Blade — show UI only if authorized --}}
@can('update', $post)
<a href="{{ route('posts.edit', $post) }}">Edit</a>
@endcan
Method authorize()/can() (lan @can ing Blade) mriksa policy kanthi otomatis — nambah 403 utawa nyembunyikake UI nalika pengguna ora diidini.
Dene iki penting
Authorization iku penting lan kritis kanggo security — ngontrol apa sing diidinine pengguna sing wis authenticated kanggo nindakake (dudu cuma apa dheweke logged in) yaiku fundamental kanggo application security, lan Laravel policies lan gates nyedhiyakake cara sing resik lan terorganisir kanggo ngatasi.
Paham bedane antarane authentication (sapa kowé — login) lan authorization (apa sing bisa kowé gawe — permissions) yaiku foundational, lan kegagalan authorization ndadeli kerentanan serius (pengguna akses utawa nganyari data sing mesthi ora — broken access control yaiku top security risk).
System Laravel nyedhiyakake rong alat sing saling melengkapi: Gates kanggo permissions sederhana, standalone (closure-based checks), lan Policies — cara umum, recommended — sing ngorganisir rules authorization model menyang class khusus (contone sapa bisa nganyari utawa ngilangi Post), njaga logic authorization terstruktur lan maintainable per resource.
Paham cara ndefine policies/gates lan enforce ([$this->authorize(), $user->can(), @can` ing Blade — mriksa permissions ing controllers, nambah 403s, lan kondisional nampilake UI) iku penting kanggo membangun aplikasi aman nalika pengguna mung bisa nindakake actions sing diidni.
Amarga meh saben aplikasi real butuh fine-grained access control (njamin pengguna mung bisa nganyari resources dheweke dhewe, batasi admin actions, lsp.), lan amarga entuk authorization salah nggawe holes security ndadak, paham Laravel policies lan gates — cara proper, terorganisir kanggo implementasi authorization — iku penting security-relevant senior knowledge sing essential kanggo membangun aplikasi sing bener-bener enforce sapa bisa gawe apa, requirement frequent lan critical ing sistem real.