Laravel 5.x - Custom middleware for authenticating a PIN - laravel

Question

I have read the middleware documentation for Laravel yet I feel like im misunderstanding something.
What I want to do is simply to authenticate everytime before being able to view a book.
E.g. If I go to '\book\funnybook' redirect => '\book\funnybook\authenticate' (which says enter a PIN number)
The problem I am having is:
I dont know where to place the redirect function (middleware? controller?)
I dont know where to retrieve the value of the user input and compare it with the database value. Meaning again where should I place it? in the middleware or controller? and how would my view call the function?

Answer 1

In post function of authenticate in Controller.. Similar below
public function postPin(Request $request){
...
...
return Redirect::intended();
}

Answer 2

Let's create a minimal example of such middleware so you'll be able to improve it from there.
From your explanation I assume that every book will have its own pin. You can change that behavior if you want something else.
First, let's create our routes for view/authenticate books:
routes/web.php
use Illuminate\Support\Facades\Route;
Route::group(['prefix' => 'book'], function () {
// view authenticated book
Route::get('{bookSlug}', 'BookController#view')->name('book.view');
// show book authenticate form
Route::get('{bookSlug}/authenticate', 'BookController#showAuth')->name('book.authenticate');
// handle user input, authenticate book
Route::post('{bookSlug}/authenticate', 'BookController#authenticate');
});
Let's also add pattern for bookSlug parameter (update boot method as shown):
app/Providers/RouteServiceProvider.php
class RouteServiceProvider extends ServiceProvider {
// ...
public function boot()
{
Route::pattern('bookSlug', '[A-Za-z0-9_-]+');
parent::boot();
}
// ...
}
Now, let's create the middleware:
php artisan make:middleware CheckPin
Every middleware has handle method that allows it to check for something and either allow request to pass next (by calling $next() closure), or stop request processing by throwing an error or redirecting to another URL.
Here, we'll check book authentication status in session. It will be stored there by auth form. If book isn't authenticated yet, we'll redirect to the auth form.
app/Http/Middleware/CheckPin.php
<?php
namespace App\Http\Middleware;
use Closure;
use Illuminate\Support\Facades\Route;
class CheckPin {
public function handle($request, Closure $next)
{
$bookSlug = Route::current()->parameter('bookSlug');
// check whether book has been authenticated
// redirect to auth form otherwise
if(!session("books.$bookSlug")) {
return redirect()->route('book.authenticate', compact('bookSlug'));
}
return $next($request);
}
}
We have to register our middleware in Kernel.php (update it as shown):
app/Http/Kernel.php
use App\Http\Middleware\CheckPin;
//...
class Kernel extends HttpKernel {
//...
protected $routeMiddleware = [
//...
'pin' => CheckPin::class, //
];
protected $middlewarePriority = [
//...
CheckPin::class,
];
//...
}
Let's create our simple views. Create resources/views/book folder and put views there.
View for displaying book content:
resources/views/book/view.blade.php
<h1>View book → {{ $bookSlug }}</h1>
<p>Some content</p>
View for display book auth form:
resources/views/book/auth.blade.php
<h1>Authenticate → {{ $bookSlug }}</h1>
<form method="post" action="{{ route('book.authenticate', compact('bookSlug')) }}">
#csrf
<label for="pin">Enter pin:</label>
<input type="password" name="pin" id="pin" required autofocus />
<button class="submit">Authenticate</button>
#error('pin')
<p>
<i><b>Error:</b> {{ $message }}</i>
</p>
#enderror
</form>
And finally, let's create book controller that will show books, auth form, and handle user input.
php artisan make:controller BookController
app/Http/Controllers/BookController.php
<?php
namespace App\Http\Controllers;
use Illuminate\Http\Request;
class BookController extends Controller {
public function __construct()
{
// "pin" middleware will protect all methods except #showAuth and #authenticate
$this->middleware('pin')->except(['showAuth', 'authenticate']);
}
function view(Request $request, string $bookSlug)
{
return view('book.view', compact('bookSlug'));
}
function showAuth(Request $request, string $bookSlug)
{
return view('book.auth', compact('bookSlug'));
}
// handles user input, checks for valid pin
// redirects to the authenticated book or back to the form
function authenticate(Request $request, string $bookSlug)
{
$pin = $request->input('pin');
// Check book pin here; for testing purpose: pin should equal book slug
if($pin === $bookSlug) {
session()->put("books.$bookSlug", 1);
return redirect()->route('book.view', compact('bookSlug'));
}
return redirect()->back()->withErrors(['pin' => ['Invalid pin']]);
}
}
It works like this:
When user opens some book, for example book/funny it will be redirected to book/funny/authenticate where they can enter pin and authenticate the book. If the pin is valid, then user is redirected back to book/funny URL, otherwise the error is shown.
That's all. You can extend this example to better suit your needs: add more methods to BookController, check book pin from database etc.