将页面限制为管理员 - Laravel

I am having a tutorial on how to restrict pages to admins. In my RedirectIfAuthenticated.php, this is how my code looks like

public function handle($request, Closure $next, $guard = null)
{
    if (!Auth::guard($guard)->check()) {
        // return redirect('/login');
    } else {
        $user = Auth::user();
        if($user->hasRole('manager')) {
            return redirect('admin/home');
        } else {
            return redirect('/home');
        }
    }

    return $next($request);
}

After i login, i am routed to the respective pages but the issue is, i can still route to the admin page even tho i login as a member and not manager. When i place localhost/admin/home, i am still routed to that page although i am not a manager. What am i missing out?

I would suggest to take a look at https://www.learn2torials.com/a/laravel-authentication-based-on-roles tutorial to resolve this issue.

You have to use different middlewares based on your user types to handle their permissions

You are able to access the manager url after login because your code only redirects each user to their appropriate url's but does'nt do any other check after the users are logged in. You can accomplish this by creating a middleware to check for each user type and redirect them to their appropriate pages and attach this middleware to your desired routes.

In your terminal, run php artisan make:middleware AdminMiddleware to create a middleware Note: the AdminMiddleware is a name of my choosing and can be changed.

This creates a middleware in the app\Middlewares directory. edit the contents to look like this..

<?php

namespace App\Http\Middleware;

use Closure;

class AdminMiddleware
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        $user = Auth::user();
        if(!$user->hasRole('manager'))
        {
            //you can throw a 401 unauthorized error here instead of redirecting back
            return redirect()->back(); //this redirects all non-admins back to their previous url's
        }
        return $next($request);
    }
}

Then go to the app/Http/Kernel.php file and add the following to the $routeMiddleware array.

'admin' => \App\Http\Middleware\AdminMiddleware::class,

Now you can attach the admin middleware to any route which you would like only managers to access.