Login a user only if his status is active in Laravel 5.7

Question

I am new to Laravel and have been fairly successful in implementing user authentication. Now to move on to the next step I must allow only users whose status in active to login. For that I have added a

status TINYINT

column in my mysql users table.

I found this in the Laravel Documentation:

Specifying Additional Conditions

If you wish, you may also add extra conditions to the authentication query in addition to the user's e-mail and password. For example, we may verify that user is marked as "active":
if (Auth::attempt(['email' => $email, 'password' => $password, 'active' => 1])) {
// The user is active, not suspended, and exists.
}

Can someone please point out where I need to put this chunk. Am thoroughly confused and need some pointers.

Thanks

https://stackoverflow.com/questions/31015606/login-only-if-user-is-active-using-laravel — Masivuye Cokile, Dec 14 '18 at 13:42
@Jerodev I am using Laravel's built in auth with a couple of changes (like using username instead of email, I don't think they will be any consequence). — Debajeet Choudhury, Dec 14 '18 at 13:45
Like as said @MasivuyeCokile , There is so much solving method on this link: https://stackoverflow.com/questions/31015606/login-only-if-user-is-active-using-laravel — FGDeveloper, Dec 14 '18 at 13:47

score 14 · Accepted Answer · answered Dec 14 '18 at 14:17

14

Have this on your LoginController:

protected function credentials(Request $request)
{        
   return ['username' => $request->{$this->username()}, 'password' => $request->password, 'status' => 1];
}

answered Dec 14 '18 at 14:17

kapitan

2,008
3
20
26

`Symfony \ Component \ Debug \ Exception \ FatalThrowableError (E_RECOVERABLE_ERROR) Argument 1 passed to App\Http\Controllers\Auth\LoginController::credentials() must be an instance of App\Http\Controllers\Auth\Request, instance of Illuminate\Http\Request given, called in /Library/WebServer/Documents/transport/www/vendor/laravel/framework/src/Illuminate/Foundation/Auth/AuthenticatesUsers.php on line 81` – Debajeet Choudhury Dec 14 '18 at 14:22
2

My bad forgot to include `use Illuminate\Http\Request;` – Debajeet Choudhury Dec 14 '18 at 14:23
Accepted for the simplicity of the solution. Kudos and thanks – Debajeet Choudhury Dec 14 '18 at 14:25

score 4 · Answer 2 · answered Dec 14 '18 at 13:46

You just take user status and check user status is true or false. You can take status using Auth::User()->status from auth session. Try this.

 if(Auth::attempt(['email'=>$request->email,'password'=>$request->password])){
                $userStatus = Auth::User()->status;
                if($userStatus=='1') {
                    return redirect()->intended(url('/dashboard'));
                }else{
                    Auth::logout();
                    Session::flush();
                    return redirect(url('login'))->withInput()->with('errorMsg','You are temporary blocked. please contact to admin');
                }
            }
            else {

                return redirect(url('login'))->withInput()->with('errorMsg','Incorrect username or password. Please try again.');
            }

Where? In Auth\LoginController? – Debajeet Choudhury Dec 14 '18 at 13:59 — Debajeet Choudhury, Dec 14 '18 at 13:59
app\Http\Controllers\Auth\LoginController.php – Jasim Juwel Dec 14 '18 at 14:03 — Jasim Juwel, Dec 14 '18 at 14:03
Hi Jasim, what is the method name of your code? Thanks. – Naim R. May 24 '21 at 06:19 — Naim R., May 24 '21 at 06:19

score 3 · Answer 3 · answered Dec 14 '18 at 13:49

3

Just simply put this code in your App\Auth\LoginController or elsewhere where you have your LoginController located.

public function authenticate(Request $request)
{
    $credentials = $request->only('email', 'password');

    if (Auth::attempt(['email' => $email, 'password' => $password, 'active' => 1])) {
        // Authentication passed...
        return redirect()->intended('dashboard');
    }
}

with this code you are overriding default authenticate function

answered Dec 14 '18 at 13:49

Malkhazi Dartsmelidze

4,783
4
16
40

Am yet to try it out but your answer seems to make sense. My only concern is that I am redirecting the user to different dashboard base on a level field. For that I am using: `public function redirectTo() { $user = Auth::user(); $level = $user->level; if($level == 0) { return '/home/super'; } elseif($level == 1) { return '/home/accountant'; } else { return '/home/branch'; }` How do I handle this redirection? – Debajeet Choudhury Dec 14 '18 at 13:54
if You are redirecting it in different location you can place `protected $redirectTo = '/';` in your LoginController. – Malkhazi Dartsmelidze Dec 14 '18 at 13:56

Headway · Answer 4 · 2020-05-19T09:01:36.050

1

Add this to your LoginController:

protected function credentials(Request $request)
{        
    return [$this->username() => $request->{$this->username()}, 'password' => $request->password, 'active' => 1];
}

edited May 19 '20 at 09:01

answered May 19 '20 at 08:49

Headway

55
6

Muhammad Usama · Answer 5 · 2018-12-14T14:21:51.823

Add below method in

app\Http\Controllers\Auth\LoginController.php

and it would extend

AuthenticatesUsers trait

validateLogin method. So basically, it would check for your active clause as well.

protected function validateLogin(Request $request)
    {
        $this->validate($request, [
            $this->username() => [
                'required',
                Rule::exists('users')->where(function ($query) {
                    $query->where('active', 1);
                }),
            ],
            'password' => 'required'
        ]);
    }

OR

Place your required code in app\Http\Controllers\Auth\LoginController.php

public function authenticate(Request $request)
{
    if (Auth::attempt(['email' => $request->email, 'password' => $request->password, 'active' => 1])) {
        // The user is active, not suspended, and exists.
    }
}

score 0 · Answer 6 · answered Feb 13 '19 at 02:34

You can override authenticated() method in your App\Http\Controllers\Auth\LoginController.php like so:

protected function authenticated(Request $request, $user)
{
   if(!$user->active) {
       Auth::logout();
       abort(403);
   };
}

Do note it's quick but not very "Laravely" solution. Sloppy.

Login a user only if his status is active in Laravel 5.7

6 Answers6