Support the ongoing development of Laravel.io →
Security Forms Architecture

Hello, i am using Laravel's new feature FormRequest and every thing is nice, input validates, permissions are checked, but i need to check permissions on form view as well (it would be odd that i can access form, fill it, but on submit it tells, me: sorry, you don't have permissions to do that).

So how are you handling it?

Quick idea: It would be great, for example, extract permissions checking to its own class and when it is included in controllers method it checks permissions and redirects if it fails. Then i could in my FormRequest classes handle input validation and for permissions call this separate object. Than i could check permissions that way for everything.

Quick idea 2: I could change validatior to only work when form is submitted. So i would include the same FormRequest class both in a form view and submit methods, but input validation would only happen in second case, but permission checking on both cases.

Last updated 3 years ago.
0

I would not use FormRequest to handle auth for views, that's not what it's made for. I would normally handle this in the routes file, is there any specific reason you don't want to do that?

Last updated 3 years ago.
0

Because now i need to duplicate permissions logic in two places (FormRequest class and before form view), i want to define it in one place so it would be used before both showing form and handling its post.

So the best option would be to create separate class witch handles permissions logic:

  • GET: class can be used directly
  • POST: FormRequest class uses permission checking class in background
Last updated 3 years ago.
0

Sign in to participate in this thread!

Eventy

Your banner here too?

revati revati Joined 31 Jan 2014

Moderators

We'd like to thank these amazing companies for supporting us

Your logo here?

Laravel.io

The Laravel portal for problem solving, knowledge sharing and community building.

© 2025 Laravel.io - All rights reserved.