I am building a SaaS app in Laravel and want to give each person/company their own sub-domain. I have a `users` table with a `company_id` column. I have a `companies` table with a `sub_domain` column, which will be the sub-domain for that company. I don't want Company A to be able to visit Company B's sub-domain.

I have looked a quite a few articles and many forums on how to handle this and I am not finding any solutions that work. I am thinking that I need to use Middleware in combination with route grouping, but I just can't figure it out. Does anyone have experience with this?

Here is my `routes.php`:

```
Route::group(['domain' => '{sub_domain}.' . env('APP_DOMAIN_NAME'), 'middleware' => 'subdomain'], function() {

    Route::auth();

    Route::group(['middleware' => 'guest'], function () {
        //Route::get('/', 'PublicController@index');
        Route::get('/tickets/create', 'TicketsController@create');
        Route::post('/tickets/create', 'TicketsController@store');
    });

    Route::group(['middleware' => 'auth'], function () {
        Route::get('/tickets', 'TicketsController@index');
        Route::get('/tickets/{id}', 'TicketsController@edit');
        Route::patch('/tickets/{id}', 'TicketsController@update');
        Route::delete('/tickets/{id}', 'TicketsController@destroy');
        Route::get('/my-tickets', 'TicketsController@myTickets');
        Route::get('/tickets/close/{id}', 'TicketsController@closeTicket');

    });
});

```

The problem with this is that I can visit another sub-domain successfully. Now, I can still only view the tickets that are associated with the currently logged in user's company. I would like to throw a 403, or even just redirect back to their own sub-domain.

Here is the `Subdomain.php` middleware:

```
public function handle($request, Closure $next)
{
    $request_uri = $request->server('HTTP_HOST');
    $this->checkSubdomainExists($request_uri);

    if(Auth::check()) {
        $user = User::find(Auth::user()->id);
        if($user->company->sub_domain !== Session::get('company_sub_domain')) {
            Session::forget('company_sub_domain');
            return 'not Authed';
        }
    }

    return $next($request);
}

```