Errors "This action is unauthorized." using Form Request validations in Laravel

Question

I make some gate like this:

Gate::define('update-post', function  ($user, Post $post) {
    return $user->hasAccess(['update-post']) or $user->id == $post->user_id;
});

I checked my database and it has update-post access and the user id is same as in the post. but I got:

This action is unauthorized.

errors. so am I do some mistake here? thanks.

Kenny Horna · Accepted Answer · 2022-08-22T12:26:45.413

I had a similar problem some time ago when starting to use Form Request classes for data validation. I noticed the following:

If you are using Form Requests to validate data, then first of all, check that you set properly the authorization rule that will allow it to pass. This is handled by the authorize() method that must return a boolean, that by default is set to false:

namespace App\Http\Requests\Users;

use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Support\Facades\Auth;

class UpdateUserRequest extends FormRequest
{
    /**
     * Determine if the user is authorized to make this request.
     *
     * @return bool
     */
    public function authorize()   
    {
        /** 
         * By default it returns false, change it to 
         * something like this if u are checking authentication
         */
        return Auth::check(); // <-------

        /** 
         * You could also use something more granular, like
         * a policy rule or an admin validation like this:
         * return auth()->user()->isAdmin();
         * 
         * Or just return true if you handle the authorisation
         * anywhere else:
         * return true;
         */ 
    }

    public function rules()
    {
        // your validations...
    }

}

Perfect!!! I'd just improve the answer saying to use Illuminate\Support\Facades\Auth; — LuizEduardoMPF, May 08 '19 at 09:58

score 23 · Answer 2 · edited Oct 27 '18 at 23:41

23

Make sure you return true on "authorize" method

public function authorize()
{
    return true;
}

edited Oct 27 '18 at 23:41

Kenny Horna

13,485
4
44
71

answered Feb 24 '18 at 14:24

Rajesh Chaudhary

894
2
11
17

For Laravel 9: `public function authorize($ability, $arguments = [])` – user1597430 Jun 25 '22 at 18:03
That looks risky... You're authorizing ANYONE to run it. Something like `return $this->user() != null;` is a bit safer, as only logged-in users would be authorized. – Borjovsky Jun 02 '23 at 19:53

James Mascarenhas · Answer 3 · 2023-01-18T08:43:11.360

11

For Laravel 8(also applicable to Laravel 9) go to folder app->http->requests choose the class file(in my case it was StoreStudentRequest.php) and in function authorize set return value to true;

public function authorize()
{
    return true;
}

edited Jan 18 '23 at 08:43

answered Jan 21 '22 at 07:51

James Mascarenhas

567
5
14

score 5 · Answer 4 · answered Apr 12 '20 at 14:51

This problem occurred to me when I did not return true in php artisan make:request SellRequest in functionpublic function authorize()

<?php

namespace App\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;

class SellRequest extends FormRequest
{
    /**
     * Determine if the user is authorized to make this request.
     *
     * @return bool
     */
        public function authorize()
    {
        return true;
    }

    /**
     * Get the validation rules that apply to the request.
     *
     * @return array
     */
    public function rules()
    {
        return [
            'city'=>'required',
            'address'=>'required',
            'type'=>'required',
            'land'=>'required',
            'area'=>'required'
        ];
    }
}

score 2 · Answer 5 · edited Oct 27 '18 at 23:41

<?php 
namespace App\Modules\UserManagement\Request;

use Illuminate\Foundation\Http\FormRequest;
use Response;

class UserRequest extends FormRequest
{
     /**
     * Determine if the user is authorized to make this request.
     *
     * @return bool
     */
    public function authorize()
    {
        return true;
    }


    public function rules()
    {

        $rules = [
            'full_name' => 'required',
            'email' => 'required|email',
            'password' => 'required',
            're_enter_password' => 'required'
        ];

        return $rules;
    }
}

score 2 · Answer 6 · answered Oct 13 '21 at 08:35

2

Need to authorize function return true

public function authorize()
{
    return TRUE;
}

and then add auth facade or use Auth;

answered Oct 13 '21 at 08:35

fahdshaykh

472
3
10

score 0 · Answer 7 · answered Jul 19 '19 at 12:22

0

In my case, I was not doing the right check in Gate::define(...)

So maybe double check your logic in that function

answered Jul 19 '19 at 12:22

Luca C.

11,714
1
86
77

score 0 · Answer 8 · answered Aug 21 '22 at 14:28

If you have already configured your authorize() and you still have the same problem, you may check your route/api.php You may have a error declaring the same path for 2 Controller.

Route::resource('users', UserController::class)/*authorized true*/;
Route::resource('users', User2Controller::class)/*unauthorized true*/;

score 0 · Answer 9 · answered Nov 04 '22 at 10:31

0

add this line in your controller

**use Illuminate\Http\Request;**

instead of

use App\Http\Requests\StoreGameRequest;

and change the parameter in function as

public function store(**Request $request**)
    {
        $request->validate([

answered Nov 04 '22 at 10:31

Smoke

89
1
8
15

Errors "This action is unauthorized." using Form Request validations in Laravel

9 Answers9

Linked