As the title says, there are three main privileges.

Role_group is divided into end users, administration, and development.

Although it is overridden in LoginController.php, the login destination after login is divided by authority.

     * Overrides protected $redirectTo.
     * @return string
     * /
    protected function redirectTo ()
        \ Log :: info ('After login'. GetPermissionDefaultRoute ());
        return route ('development.default');
if (! function_exists ('getPermissionDefaultRoute')) {
    / **
     * @return string | void
     * /
    function getPermissionDefaultRoute ()
        if (Auth :: user ()->isDevelopmentGroup ()) {
            return route ('I can't show you A');
        if (Auth :: user ()->isSupportGroup ()) {
            return route ('I can't show you B');
        if (Auth :: user ()->isEndUserGroup ()) {
            return route ('I can't show you C');
        abort (500, 'Inconsistent root authority'));

RedirectIfAuthenticated.phpuses the same helper.

When I log in with three privileges, it is skipped to the top page (https://example.com/) for some reason.
Since the top page is the default default page for end users,This action is unauthorized.and 403 error occurs when you log in with the operation account and development account.

When you back-browser, the URL specified by getPermissionDefaultRoute is displayed in the browser's URL bar.
Probably once i am properly logged in according to your authority.

It is only necessary to know where and why 403 occurs in the state before the transition, but it is difficult because X debugging is not installed.

Is there anyone who has any idea about this?

I don't think it matters much, but

End users can only see the end user's page,
Management can only see the management page,
Development can see the development page as well as the administration page

Gates are defined in Providers.
I use it in middleware.

I think that there is no problem here because it is accessible by back browser.


When logging in for the first time in a secret window such as google or firefox, you will jump to the login destination according to your authority.
If i log out and log in again, you will fly to the route.

Is there any kind of session involved?
Even so, where do you fly to the route,

  • Answer # 1

    It was raining in May, but it was solved by explicitly specifying the transition destination when logging out.

    protected function loggedOut (Request $request)
             return redirect (route ('login'));

    Because it was rooted at the end user's default page,
    After logging out with each permission, go to end user default page
    Since it was not authenticated, a 403 error was displayed.

    Why the login destination was root
    I don't know the fundamental part of it ...

    For reference, the user table is not divided in this example.

    The authority is managed below.
    Authority group->Authority subgroup->Authority->User

    Three routing files have been created, and middleware (Gate) that restricts access by role_id, role_sub_group_id, or role_group_id is designed for each routing file.

    Prefix is ​​added to url for each routing file.

    I don't think there is a problem with making it, but I couldn't access the login unless I explicitly specified the transition destination when logging out. (Mystery because sometimes I could access it)

Related articles