> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: Use Route Groups!
- URL: https://securinglaravel.com/security-tip-use-route-groups/
- Published: 2022-06-14T01:00:31.000Z
- Updated: 2024-11-21T04:00:26.000Z
- Description: [Tip#24] It may sound trivial, but it's easy to overlook.
- Author: Stephen Rees-Carter
- Tags: Security Tips, Authentication, Routing, Authorisation

[Route Groups](https://laravel.com/docs/routing?ref=securinglaravel.com#route-groups) are awesome for so many reasons, and as you’d expected, one of those reasons is **security**. Not only do they make it easy to review the access requirements for each of your routes in the one place but they also serve as a fantastic reminder that you need to be aware of the permissions for each of your routes.

Consider this: when adding a new route, you’ll open up the routes file, and look for a suitable place to put it. If everything is grouped, you need to decide what access level that route needs when you add it. You’re unlikely to forget and your app stays secure.

Alternatively, if you leave your access control in your controllers, you’ll add your route somewhere, open up a blank controller and start coding… and sometimes forget about access control, leaving an endpoint wide open.

**I recommend implementing as much of your access control as possible through middleware.**

You’ve got the default `auth` and `guest` helpers for basic authentication checks, with [Policy Objects](https://securinglaravel.com/in-depth-policy-objects) to handle more complex rules, but if the app I’m working on requires something more complicated, I’ll implement some [custom middleware](https://laravel.com/docs/middleware?ref=securinglaravel.com#defining-middleware) to handle that logic too. That way it’s all encompassed within middleware and the route layer, making it harder for me to overlook and forget.

As a quick guide:

**Authenticated Users Only**

```
Route::middleware(['auth'])->group(function () {
    // ...
});
```

**Unauthenticated Guests Only**

```
// Authenticated Users Only
Route::middleware(['guest'])->group(function () {
    // ...
});
```

**Authenticated With Specific Auth Guard Only**

```
Route::middleware(['auth:admin'])->group(function () {
    // ...
});
```

**Authenticated & Product Policy Approved Only**

```
Route::middleware(['auth'])->group(function () {
    // ...

    Route::middleware(['can:view,product'])->group(function () {
        // ..
    });
});
```

**Authenticated & Custom Control**

```
Route::middleware(['auth'])->group(function () {
    // ...

    Route::middleware(['editor'])->group(function () {
        // ..
    });
});
```

**Useful Documentation:**

1. [Route Groups](https://laravel.com/docs/routing?ref=securinglaravel.com#route-groups)
2. [Route Group Middleware](https://laravel.com/docs/routing?ref=securinglaravel.com#route-group-middleware)
3. [Route Authentication Middleware](https://laravel.com/docs/authentication?ref=securinglaravel.com#protecting-routes)
4. [Default Middleware](https://laravel.com/docs/middleware?ref=securinglaravel.com#assigning-middleware-to-routes)

---

***If you found this security tip useful,*** [***subscribe***](#/portal/signup) ***to get weekly*** [***Security Tips***](https://securinglaravel.com/tag/tips/) **straight to your inbox.* Upgrade to a* [*premium subscription*](#/portal/signup) *for exclusive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*, or drop a coin in the* [*tip jar*](#/portal/support) *to show your support.*

*Looking for a* [*Laravel Security Audit / Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com)*, or a budget-friendly* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*? Feel free to reach out! You can also connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*. And don’t miss* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*