Restrict for DevDojo Auth Setup to Admin users #177
Conversation
There was a problem hiding this comment.
There is actually a redirect from /auth/setup to /dashboard already available out of the box as a security feature when the APP_ENV in your .env file is set to production. This ensures that access to the setup page is disabled in production environments to protect your app.
To access the setup page, you can temporarily change the APP_ENV value in your .env file to local. This will prevent the redirect and allow you to complete the setup process.
Once you’ve finished setting up the authentication, make sure to change the APP_ENV value back to production before deploying your app. This step is important to prevent unauthorized access to the setup page in a live environment.
This PR looks ok to me for adding that extra protection, but will leave the decision if this should be merged to @tnylea.
At the moment any user can visit the route
/auth/setupand make changes. Restricting the /auth/setup/* to admin users only.I also added AdminOnlyRoutes Middleware for future use, if there are other routes.