Vfrdtyky

I have isActive middleware where I set 1 to acitive and 0 when user is not active.

isActive.php inMiddleware folder look like this:



namespace AppHttpMiddleware;



use Closure;

use IlluminateSupportFacadesAuth;



class IsActive

{

    /**

     * Handle an incoming request.

     *

     * @param  IlluminateHttpRequest  $request

     * @param  Closure  $next

     * @return mixed

     */

    public function handle($request, Closure $next)

    {

        if (Auth::check()) {

          if (Auth::user()->isActive()) {

            return $next($request);

          }

        }



        return redirect('/')->with('nonActive', 'Account is not active');

    }

}

and I have method in User model:

public function isActive()

{

    if ($this->is_active == 1) {

        return true;

    }



    return false;

}

In Kernel.php in protected $routeMiddleware I add this:

'is.active' => AppHttpMiddlewareIsActive::class,

and I have group middleware in routes and all this works fine.

But, when isActive Middleware return false I can't login with different user. Always get return false as if that user is inactive too until I delete cookies. After deleting I can login just fine with user that is active.

Your route group:

Route::group(['middleware' => 'auth'], function () {

    // your active and auth user routes

});    

If you want a user to be active in order to authenticate, use a global scope in your User model:

use IlluminateDatabaseEloquentModel;

use IlluminateDatabaseEloquentBuilder;



class User extends Model

{

    ...

    protected static function boot()

    {

        parent::boot();



        static::addGlobalScope('isactive', function (Builder $builder) {

            $builder->where('is_active', '=', 1);

        });

    }

    ...

}

This way a user will not be found unless they are active and you won't need the IsActive middleware.

Source: https://laravel.com/docs/5.7/eloquent#global-scopes

To customize authentication failure errors override sendFailedLoginResponse in your LoginController

protected function sendFailedLoginResponse(Request $request)

{

    return redirect('/')->with('nonActive', 'Account is not active');

}

Don't redirect if Auth::check() returns false..

Change your logic around:

    if (Auth::check()) {

      if (!Auth::user()->isActive()) {

        return redirect('/')->with('nonActive', 'Account is not active');

      }

    }



    return $next($request);

You could also simplify that to one if statement. You may also consider logging the user out before you redirect.