authorizeResource alternatives

[uikolas]

After upgrading to Laravel 11 I noticed that 11 version dropped documentation for resource authorization link to 10 version resource docs and in 11 version it does not exists

And as new version propose to use clean base controller, but we can still use AuthorizesRequests trait.
But then authorizeResource method stops working, since it does have access to middleware function anymore

So maybe a new handy approach exist to set Policy on resource controller?

I know I can extend the base controller. But since the docs are removed I guess a new approach should exist?
Also I know I can add on each resource method, to check if user is authorized. But maybe we can do it more simpler?

[Khazl]

I have noticed the same thing and am facing the same problem.
Is there an official best practice for this?

[MorganGonzales]

I assume that Laravel 11 is heading towards being specific in defining authorization rules, so probably having a Gate::authorize definition for each controller action, instead of using the authorizeResource which is very global. And I think this is the best practice for Laravel 11.

[Khazl]

having a Gate::authorize definition for each controller action

Doesn't necessarily sound like a good alternative and a planned best practice.
That's exactly why the question comes up. Can anyone officially confirm that this is the case?

[i6media]

You can still extend the \Illuminate\Routing\Controller instead of App\Http\Controllers\Controller and use the \Illuminate\Foundation\Auth\Access\AuthorizesRequests\AuthorizesRequests in your custom controllers in Laravel 11:

<?php

class FooController extends \Illuminate\Routing\Controller
{
    use \Illuminate\Foundation\Auth\Access\AuthorizesRequests;

    public function __construct()
    {
        $this->authorizeResource(FooResource::class, 'parameter');
    }
}

[hesham-fouda]

In this case you can't use Illuminate\Routing\Controllers\HasMiddleware

[GautierDele]

@taylorotwell is there a particular reason you removed this in the documentation on this commit ?
laravel/docs@745bab3

Just to be sure this is not about to be deprecated 😄

[aplauche]

This is really disappointing if it is being removed. Needing to specify for each method in the controller negates a big benefit of resource controllers. Without authorizeResource it feels better to manually specify each route and use middleware. This feels like a critical component of the idea of a "resource".

[crynobone]

There no where in the upgrade guide saying Illuminate\Http\Controller was deprecated, it just not being configured as the default.

[aplauche]

Got it, just saw the comment above that mentioned deprecation, and also wanted to clarify whether that was the case, but happy to hear it is just a defaults change! Will continue to just use http controller. Thanks!