PHP Academy · Lesson

Gates: Simple Authorization Checks

Define and evaluate gates for user-action permission logic.

Gates: Simple Authorization Checks is a free PHP Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the PHP Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What Are Gates?

Laravel Gates are closures that determine if a user is authorised to perform a given action. They are simple, global authorization checks not tied to a specific model.

Defining a Gate

Define gates in App\Providers\AppServiceProvider or a dedicated AuthServiceProvider using the Gate facade.

<?php
use Illuminate\Support\Facades\Gate;

// In a service provider's boot() method:
Gate::define("delete-post", function (User $user, Post $post) {
    return $user->id === $post->user_id;
});

Checking a Gate (allows/denies)

Check gate results with Gate::allows() or Gate::denies().

<?php
if (Gate::allows("delete-post", $post)) {
    $post->delete();
}

if (Gate::denies("delete-post", $post)) {
    abort(403);
}

authorize() in Controllers

Call $this->authorize() inside a controller — it throws AuthorizationException (403) automatically on failure.

<?php
public function destroy(Post $post): RedirectResponse
{
    $this->authorize("delete-post", $post);
    $post->delete();
    return redirect()->route("posts.index");
}

@can in Blade

Use the @can directive to conditionally show UI based on gate checks.

@can('delete-post', $post)
    <form method="POST" action="/posts/{{ $post->id }}">
        @csrf @method('DELETE')
        <button>Delete</button>
    </form>
@endcan

Gate::before

The before callback runs before all other gate checks — useful for granting admins blanket access.

<?php
Gate::before(function (User $user, string $ability) {
    if ($user->isAdmin()) return true; // skip further checks
});

Gate::after

after runs after all gate checks. A non-null return value overrides the gate result.

Returning Responses

Gates can return a Response object for custom error messages.

<?php
Gate::define("publish-post", function (User $user, Post $post) {
    return $user->isEditor()
        ? Response::allow()
        : Response::deny("You must be an editor to publish.");
});

forUser()

Check a gate for a different user (not the authenticated one).

<?php
if (Gate::forUser($otherUser)->allows("delete-post", $post)) {
    // ...
}

Guest Users

By default gates automatically return false for unauthenticated users. Type-hint the user as nullable to allow guest checks.

<?php
Gate::define("view-post", function (?User $user, Post $post) {
    return $post->is_published || $user?->id === $post->user_id;
});

Gates vs Policies

Gates are simple closures for ad-hoc checks. Policies are classes for model-based authorization — use policies when you have multiple actions on the same model.

Summary

Gates are global authorization closures. Define them in a service provider. Check with Gate::allows(), $this->authorize(), or @can in Blade.

Quick Check

Which controller method throws 403 automatically on gate failure?

Frequently asked questions

Is the “Gates: Simple Authorization Checks” lesson free?

Yes — the full text of “Gates: Simple Authorization Checks” is free to read here on the web, and the PHP Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the PHP Academy course, upgrade to CoddyKit PRO.

What will I learn in “Gates: Simple Authorization Checks”?

Define and evaluate gates for user-action permission logic. You practise PHP Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start PHP Academy?

No prior experience is required. PHP Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Gates: Simple Authorization Checks” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this PHP Academy lesson?

Yes. Every PHP Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to PHP Academy