Why this lesson matters

Understand sessions and authentication concepts and apply it in a small Laravel feature. Middleware handles request-wide checks, authentication establishes identity, sessions preserve trusted state, and authorization decides whether that identity may perform a specific action.

How to reason about it

  • For Sessions and Authentication Concepts, the outcome to verify is: Authentication answers who you are; policy authorization answers whether this operation is allowed.
  • In Sessions and Authentication Concepts, keep this failure controlled: Hiding a button is not authorization; every protected mutation must enforce the permission or policy on the server.
  • Sessions and Authentication Concepts practice target: Protect one route with authentication and a policy, then verify unauthenticated, forbidden and allowed cases separately.

Practical walkthrough

In the Sessions and Authentication Concepts walkthrough: Authentication answers who you are; policy authorization answers whether this operation is allowed.

app/Policies/OrderPolicy.phpphp
public function update(User $user, Order $order): bool
{
    return $order->user_id === $user->id;
}

Practice it yourself

Practice

Sessions and Authentication Concepts exercise

Protect one route with authentication and a policy, then verify unauthenticated, forbidden and allowed cases separately.

  • Record the expected result before execution
  • Test one valid path and one lesson-specific failure path
  • Explain in two lines which boundary owns the decision

Summary