Laravel middleware doesnt work to filter logged users

Question

Im trying to use middleware to filter users who hasnt logged in. Somehow users who has logged out still can get inside the routes that are protected by the middleware. I dont know which is the problem here. Here are the files

my route

Route::view("/",'loginmhs');
Route::get('/loginmhs', function () {
    return view('loginmhs');
});
Route::post("mhslogin",[LoginController::class,'mhslogin']);
Route::get('/logout',[LoginController::class,'logout']);

Route::group(['middleware'=>['protectedPage']], function(){
    Route::get('/dashboard', function () {
        return view('dashboardmhs');
    });
    Route::get('/profil', function () {
        return view('profil');
    });
});

LoginController

public function mhslogin(Request $req){
  $datareq = $req->input();

  $data = DB::table('tbl_mahasiswa')
  ->join('tbl_prodi', 'tbl_mahasiswa.id_prodi', '=', 'tbl_prodi.id_prodi')
  ->where('nim', $req->nim)->first();
  if(!$data){
    return redirect('/loginmhs')->with('alert','NIM tidak ditemukan...Cek kembali NIM anda.')->with('cek','dikirim');
  }
  if($req->password == $data->password){
    $req->session()->put('nim', $data->nim);
    $req->session()->put('nama', $data->nama);
    $req->session()->put('email', $data->email);
    $req->session()->put('password', $data->password);
    $req->session()->put('stambuk', $data->stambuk);
    $req->session()->put('id_prodi', $data->id_prodi);
    $req->session()->put('nama_prodi', $data->nama_prodi);
    return redirect('/profil');
  }
  return redirect('/loginmhs')->with('alert','Password anda salah!');
}
public function logout(){
  if(session()->has('nim')||session()->has('nip')){
    session()->forget('nim');
    session()->forget('nama');
    session()->forget('email');
    session()->forget('password');
    session()->forget('stambuk');
    session()->forget('id_prodi');
    session()->forget('nama_prodi');
    session()->save();
  }
  return redirect('/');
}

Middleware loginSessionCheck

public function handle(Request $request, Closure $next)
{
    if(!session()->has('nim')){
      return redirect('/')
    }
    return $next($request);
}

kernel

'protectedPage' => [
      \App\Http\Middleware\loginSessionCheck::class,
    ],

user_1220364 · Answer

The reason is that for the routes you are trying to protect doesn't have access to session. You must also include web middleware group to the group containing protected routes.

Route::middleware(['web', 'protectedPage'])
    ->group(function() {
        Route::get('/dashboard', function () {
            return view('dashboardmhs');
        });
        Route::get('/profil', function () {
            return view('profil');
        });
    });

Laravel middleware doesnt work to filter logged users

1 Answers