title: prevent unauthorized users to access admin pages in laravel 5
body: <p>I try many ways for that but even if users do not logined , can open secret admin pages.<br>
  this Route is for admin directory:  </p>
  
  <pre><code>Route::group(
          array (
              'prefix' =&gt; 'admin',
          ),
          function () {
              Route::resource('posts', 'postController');
  
              Route::get('/login', array ('uses' =&gt; 'loginController@showForm'));
              Route::post('/login', array ('uses' =&gt; 'loginController@checkLogin'));
  
              Route::get('/logOut', array ('uses' =&gt; 'loginController@doLogout'));
  
          }
      );  
  </code></pre>
  
  <p>And this is my Login Controller :  </p>
  
  <pre><code>namespace App\Http\Controllers;
  
  use App\Http\Requests;
  use Illuminate\Support\Facades\Input;
  use Illuminate\Support\Facades\Redirect;
  use Illuminate\Support\Facades\View;
  
  class loginController extends Controller
  {
      public function showForm ()
      {
          return View::make('admin.login');
      }
  
      public function checkLogin ()
      {
          $data  = \Input::all();
          $rules = array (
              'username' =&gt; 'alpha_num|min:3',
              'password' =&gt; 'alpha_num|min:3',
          );
  
          $validator = \Validator::make($data, $rules);
  
          if ($validator-&gt;fails()) {
              return \Redirect::to('admin')-&gt;withErrors($validator)-&gt;withInput(\Input::all());
          } else {
  
              $enteredData    =   array(
                  'username'  =&gt;  Input::get('username'),
                  'password'  =&gt;  Input::get('password')
              );
  
              if (\Auth::attempt($enteredData)) {
                  return \Redirect::to('admin/posts');
              } else {
                  echo 'the data is Wrong ';
              }
  
          }
  
  
      }
  
      public function doLogout(){
  
          \Auth::logout();
          return Redirect::to('/admin/login');
      }
  }
  </code></pre>
  
  <p>And this part is <strong>postController</strong>:  </p>
  
  <pre><code>namespace App\Http\Controllers;
  
  use App\Http\Requests;
  use App\Post;
  use Illuminate\Http\Request;
  use Illuminate\Support\Facades\Auth;
  use Illuminate\Support\Facades\Input;
  use Illuminate\Support\Facades\Redirect;
  use Illuminate\Support\Facades\View;
  
  class postController extends Controller
  {
  
      public function __construct ()
      {
          var_dump(\Auth::check());
          if (!\Auth::check()) {
              return \Redirect::to('/admin/login');
          }
      }
      /**
       * Display a listing of the resource.
       *
       * @return Response
       */
      public function index ()
      {
          $allPosts   =   Post::all();
          return \View::make('admin.pages.posts')-&gt;with('posts',$allPosts);
      }
  
      /**
       * Show the form for creating a new resource.
       *
       * @return Response
       */
      public function create ()
      {
          return \View::make('admin.pages.post_create');
      }
  
      /**
       * Store a newly created resource in storage.
       *
       * @param  Request $request
       * @return Response
       */
      public function store (Request $request)
      {
          $data = Input::all();
  
          $rules = array (
              'post_title' =&gt; 'required',
              'post_desc'  =&gt; 'required'
          );
  
          $validator = \Validator::make($data, $rules);
  
          if ($validator-&gt;fails()) {
              return \Redirect::to('/admin/posts/create')
                  -&gt;withErrors($validator)
                  -&gt;withInput();
          } else {
  
              $post             = new Post();
              $post-&gt;post_title = $data['post_title'];
              $post-&gt;post_desc  = $data['post_desc'];
              $post-&gt;save();
  
              return \Redirect::to('/admin/posts');
          }
      }
  
      /**
       * Display the specified resource.
       *
       * @param  int $id
       * @return Response
       */
      public function show ($id)
      {
          $post   =   Post::find($id);
  
          return \View::make('admin.pages.show_post')-&gt;with('post',$post);
      }
  
      /**
       * Show the form for editing the specified resource.
       *
       * @param  int $id
       * @return Response
       */
      public function edit ($id)
      {
          $post   =   Post::find($id);
          return \View::make('admin.pages.edit_post')-&gt;with('post',$post);
      }
  
      /**
       * Update the specified resource in storage.
       *
       * @param  Request $request
       * @param  int     $id
       * @return Response
       */
      public function update (Request $request, $id)
      {
          $data = Input::all();
  
          $rules = array (
              'post_title' =&gt; 'required',
              'post_desc'  =&gt; 'required'
          );
  
          $validator = \Validator::make($data, $rules);
  
          if ($validator-&gt;fails()) {
              return \Redirect::to('post/create')
                  -&gt;withErrors($validator)
                  -&gt;withInput();
          } else {
  
              $post             = Post::find($id);
              $post-&gt;post_title = $data['post_title'];
              $post-&gt;post_desc  = $data['post_desc'];
              $post-&gt;save();
  
              return \Redirect::to('admin/posts');
          }
      }
  
      /**
       * Remove the specified resource from storage.
       *
       * @param  int $id
       * @return Response
       */
      public function destroy ($id)
      {
          $post   =   Post::find($id);
          $post-&gt;delete();
  
          return Redirect::to('admin/posts');
      }
  }
  </code></pre>
  
  <p>Be Care that i add a construct method to control not logged users and Redirect them to login page :  </p>
  
  <pre><code>public function __construct ()
      {
          var_dump(Auth::check());
          if (!Auth::check()) {
              return Redirect::to('/admin/login');
          }
      }
  </code></pre>
  
  <p><strong>var_dump</strong> return <strong>true</strong> for logged user and <strong>false</strong> for others But Redirect action do not be.   </p>
  
  <p>Where is the problem?</p>
  
  <p><strong>Update :</strong><br>
  i change posts route resource to :  </p>
  
  <pre><code>Route::resource('posts', 'postController',array('middleware' =&gt; 'auth'));
  </code></pre>
  
  <p>but it was Ineffective.<br>
  However when I change Construct postController to :  </p>
  
  <pre><code>public function __construct ()
      {
          $this-&gt;middleware('auth');
  
  
      }
  </code></pre>
  
  <p>it worked fine.</p>