LARAVEL LARAVEL Authentication & Security 2 — Questions and Answers
Question 1: What is the role of Gates in Laravel's authorization system?
- To define simple closure-based authorization rules for actions (Correct answer)
- To manage API rate limiting
- To enforce database row-level security
- To authenticate third-party OAuth providers
Correct answer: To define simple closure-based authorization rules for actions
Gates are closures registered in a service provider that determine whether a user is authorized to perform a given action.
Question 2: What is a Laravel Policy used for?
- Organizing authorization logic for a specific Eloquent model into a dedicated class (Correct answer)
- Defining application configuration policies
- Enforcing GDPR data retention rules
- Setting HTTP security headers
Correct answer: Organizing authorization logic for a specific Eloquent model into a dedicated class
Policies are classes that group authorization methods for a model, providing a clean place to define who can view, update, or delete model instances.
Question 3: Which Artisan command generates a new policy class in Laravel?
- php artisan make:policy PostPolicy --model=Post (Correct answer)
- php artisan create:policy PostPolicy
- php artisan generate:policy PostPolicy
- php artisan policy:make PostPolicy
Correct answer: php artisan make:policy PostPolicy --model=Post
php artisan make:policy generates a policy class, and the --model flag pre-fills CRUD authorization method stubs for the given model.
Question 4: Where do you typically register Policies in a Laravel application?
- In the $policies array inside App\Providers\AuthServiceProvider (Correct answer)
- In the routes/auth.php file
- In the config/auth.php configuration file
- In the .env file under AUTH_POLICIES
Correct answer: In the $policies array inside App\Providers\AuthServiceProvider
The AuthServiceProvider's $policies array maps Eloquent models to their corresponding policy classes for automatic discovery.
Question 5: What does the `@can` Blade directive do in Laravel templates?
- Renders content only if the authenticated user is authorized for the given ability (Correct answer)
- Checks if a user has a specific role
- Verifies that a CSRF token is valid
- Conditionally renders if the user is an admin
Correct answer: Renders content only if the authenticated user is authorized for the given ability
The @can directive calls the authorization gate and only renders the enclosed Blade content when the user passes the authorization check.
Question 6: What is the purpose of the `signed` middleware in Laravel?
- To validate that incoming URLs have a valid cryptographic signature (Correct answer)
- To verify the user's digital certificate
- To sign response headers with the app key
- To authenticate webhook payloads
Correct answer: To validate that incoming URLs have a valid cryptographic signature
The signed middleware ensures the URL contains a valid HMAC signature generated by URL::signedRoute(), protecting against URL tampering.
LARAVEL LARAVEL Authentication & Security 2
What is the role of Gates in Laravel's authorization system?