blocks|key|1361661|text|是的，在您的策略中创建一个简单的all方法，该方法将在所有其他授权检查之前执行，|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1361662|public+function+before($user,+$ability,Request+$request)
{
++++if+(!yourconditiontrue)+{
+++++++++if+($request->ajax())+{
++++++++++++return+response('Unauthorized.',+401);
++++++++}+else+{
++++++++++++return+abort('403');
++++++++}
++++}
}|code-block|syntax|javascript|1361663|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Yes, make a simple before method in your policy which will be executed prior to all other authorization checks, 

<pre><code>public function before($user, $ability,Request $request)
{
 if (!yourconditiontrue) {
 if ($request-&gt;ajax()) {
 return response('Unauthorized.', 401);
 } else {
 return abort('403');
 }
 }
}
</code></pre>

blocks|key|1359804|text|我们通过修改在App\Exceptions\Handler.php中找到的异常处理程序来解决这个问题，将它添加到render函数中。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1359805|public+function+render($request,+Exception+$e)
{
++++if+($e+instanceof+AuthorizationException)
++++{
++++++++return+response()->json(['error'+=>+'Not+authorized.'],403);
++++}
++++return+parent::render($request,+$e);
}|code-block|syntax|javascript|1359806|entityMap^0|7|Q|1K|6|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@$9|N|A|O|B|C]|$9|P|A|Q|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|R|8|@]|D|@]|E|$I|J]]|$1|K|3|-4|5|6|7|S|8|@]|D|@]|E|$]]]|L|$]]

We managed to resolve this by modifying the exceptions handler found in <code>App\Exceptions\Handler.php</code> adding it in the <code>render</code> function.

<pre><code>public function render($request, Exception $e)
{
 if ($e instanceof AuthorizationException)
 {
 return response()-&gt;json(['error' =&gt; 'Not authorized.'],403);
 }
 return parent::render($request, $e);
}
</code></pre>

blocks|key|1359813|text|您可以拦截异常。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1359814|++++try+{
++++++++$this->authorize('update',+$data);
++++}+catch+(\Exception+$e)
++++{
++++++++return+response()->json(null,+403);
++++}|code-block|syntax|javascript|1359815|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

You can intercept the exception 

<pre><code> try {
 $this-&gt;authorize('update', $data);
 } catch (\Exception $e)
 {
 return response()-&gt;json(null, 403);
 }
</code></pre>

blocks|key|1361706|text|至于最新版本的Laravel，现在的版本是>=7.x，|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1361707|通常，设置请求头'Accept‘=>+'application/+json+'会告诉Laravel您希望json响应返回。|offset|length|style|BOLD|1361708|对于错误，还需要通过在APP_DEBUG=false文件上设置.env来关闭调试，这将确保响应是json，并且不提供堆栈跟踪。|1361709|entityMap^0|0|8|V|0|B|F|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|M|8|@$D|N|E|O|F|G]]|9|@]|A|$]]|$1|H|3|I|5|6|7|P|8|@$D|Q|E|R|F|G]]|9|@]|A|$]]|$1|J|3|-4|5|6|7|S|8|@]|9|@]|A|$]]]|K|$]]

As for the latest version of Laravel, as of now version &gt;=7.x,
Generally setting request headers 'Accept' =&gt; 'application/json' will tell Laravel that you expect a json response back.
For errors you need to also turn off debugging by setting the APP_DEBUG=false on your .env file, which will make sure the response is json and no stacktrace is provided.

blocks|key|2667439|text|接受的答案有效，但是如果您不想为每个路由返回json，您可以使用中间件来处理这个问题。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2667440|关于如何做到这一点的简要概述：|2667441|创建一个ApiAuthorization类并扩展主要的auth类。|offset|length|style|CODE|2667442|<?php

namespace+App\Http\Middleware;

use+Closure;
use+Illuminate\Http\Request;
use+Illuminate\Auth\Middleware\Authorize;
use+Illuminate\Auth\Access\AuthorizationException;

class+ApiAuthorization+extends+Authorize
{
++++public+function+handle($request,+Closure+$next,+$ability,+...$models)
++++{
++++++++try+{
++++++++++++$this->auth->authenticate();

++++++++++++$this->gate->authorize($ability,+$this->getGateArguments($request,+$models));
++++++++}+catch+(AuthorizationException+$e)+{
++++++++++++return+response()->json(['error'+=>+'Not+authorized.'],403);
++++++++}

++++++++return+$next($request);
++++}
}|code-block|syntax|javascript|2667443|将中间件添加到$routeMiddleware中App\Http\Kernel.php中|2667444|'api.can'+=>+\App\Http\Middleware\ApiAuthorization::class,|2667445|更新你的路线。现在可以通过调用类似于api.can的文档中的示例来使用新的api+auth中间件。|2667446|++++Route::get('tenant',+[
++++++++'as'+=>+'api.tenant',
++++++++'uses'+=>+'TenantController@show'
++++])->middleware('api.can:show,tenant');|2667447|此方法允许您在不修改全局异常处理程序的情况下返回特定路由的json。|2667448|entityMap|0|LINK|mutability|MUTABLE|url|https://laravel.com/docs/5.8/authorization#via-middleware^0|0|0|4|G|0|0|7|G|O|J|0|0|I|7|Q|6|0|0|0|0^^$0|@$1|2|3|4|5|6|7|16|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|17|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|18|8|@$F|19|G|1A|H|I]]|9|@]|A|$]]|$1|J|3|K|5|L|7|1B|8|@]|9|@]|A|$M|N]]|$1|O|3|P|5|6|7|1C|8|@$F|1D|G|1E|H|I]|$F|1F|G|1G|H|I]]|9|@]|A|$]]|$1|Q|3|R|5|L|7|1H|8|@]|9|@]|A|$M|N]]|$1|S|3|T|5|6|7|1I|8|@$F|1J|G|1K|H|I]]|9|@$F|1L|G|1M|1|1N]]|A|$]]|$1|U|3|V|5|L|7|1O|8|@]|9|@]|A|$M|N]]|$1|W|3|X|5|6|7|1P|8|@]|9|@]|A|$]]|$1|Y|3|-4|5|6|7|1Q|8|@]|9|@]|A|$]]]|Z|$10|$5|11|12|13|A|$14|15]]]]

The accepted answer works, but if you don't want to return json for every route you can handle this with middleware.

A brief outline of how to do this:

Create an <code>ApiAuthorization</code> class and extend your main auth class.

<pre><code>&lt;?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Illuminate\Auth\Middleware\Authorize;
use Illuminate\Auth\Access\AuthorizationException;

class ApiAuthorization extends Authorize
{
 public function handle($request, Closure $next, $ability, ...$models)
 {
 try {
 $this-&gt;auth-&gt;authenticate();

 $this-&gt;gate-&gt;authorize($ability, $this-&gt;getGateArguments($request, $models));
 } catch (AuthorizationException $e) {
 return response()-&gt;json(['error' =&gt; 'Not authorized.'],403);
 }

 return $next($request);
 }
}
</code></pre>

Add the middleware to <code>$routeMiddleware</code> in <code>App\Http\Kernel.php</code>

<pre><code>'api.can' =&gt; \App\Http\Middleware\ApiAuthorization::class,
</code></pre>

Update your route. You can now use your new api auth middleware by calling <code>api.can</code> similar to <a href="https://laravel.com/docs/5.8/authorization#via-middleware" rel="nofollow noreferrer">the example in the docs</a>

<pre><code> Route::get('tenant', [
 'as' =&gt; 'api.tenant',
 'uses' =&gt; 'TenantController@show'
 ])-&gt;middleware('api.can:show,tenant');
</code></pre>

This method allows you to return json for specific routes without modifying the global exception handler.

blocks|key|1359846|text|在Laravel7.3版本中，AuthorizationException也没有被捕获，我也面临着同样的问题。我所知道的是，我们必须将AuthorizationException包括在Handler.php中|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1359847|<?php

namespace+App\Exceptions;

use+Illuminate\Foundation\Exceptions\Handler+as+ExceptionHandler;

use+Illuminate\Auth\AuthenticationException;
use+Illuminate\Auth\Access\AuthorizationException;

use+Throwable;
use+Exception;
use+Request;
use+Response;

class+Handler+extends+ExceptionHandler
{
++++//+...

++++/**
+++++*+Render+an+exception+into+an+HTTP+response.
+++++*
+++++*+@param++\Illuminate\Http\Request++$request
+++++*+@param++\Throwable++$exception
+++++*+@return+\Symfony\Component\HttpFoundation\Response
+++++*
+++++*+@throws+\Throwable
+++++*/
++++public+function+render($request,+Throwable+$exception)
++++{
++++++++if+($exception+instanceof+AuthorizationException)
++++++++{
++++++++++++return+response()->json(['message'+=>+'Forbidden'],+403);
++++++++}
++++++++if+($exception+instanceof+ModelNotFoundException+&&+$request->wantsJson())+{
++++++++++++return+response()->json(['message'+=>+'resource+not+found')],+404);
++++++++}
++++++++
++++++++return+parent::render($request,+$exception);
++++}

++++//+...
}|code-block|syntax|javascript|1359848|如果您只使用以下语句添加AuthorizationException|1359849|使用AuthorizationException；|blockquote|1359850|但还是没有用。因此，我们必须指定完全限定的命名空间路径。|1359851|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|Q|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|R|8|@]|9|@]|A|$]]|$1|I|3|J|5|K|7|S|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|T|8|@]|9|@]|A|$]]|$1|N|3|-4|5|6|7|U|8|@]|9|@]|A|$]]]|O|$]]

I have also face the same issue in Laravel version 7.3 where the AuthorizationException is not caught. What I come to know that we have to include AuthorizationException in the Handler.php like
<pre><code>&lt;?php

namespace App\Exceptions;

use Illuminate\Foundation\Exceptions\Handler as ExceptionHandler;

use Illuminate\Auth\AuthenticationException;
use Illuminate\Auth\Access\AuthorizationException;

use Throwable;
use Exception;
use Request;
use Response;

class Handler extends ExceptionHandler
{
 // ...

 /**
 * Render an exception into an HTTP response.
 *
 * @param \Illuminate\Http\Request $request
 * @param \Throwable $exception
 * @return \Symfony\Component\HttpFoundation\Response
 *
 * @throws \Throwable
 */
 public function render($request, Throwable $exception)
 {
 if ($exception instanceof AuthorizationException)
 {
 return response()-&gt;json(['message' =&gt; 'Forbidden'], 403);
 }
 if ($exception instanceof ModelNotFoundException &amp;&amp; $request-&gt;wantsJson()) {
 return response()-&gt;json(['message' =&gt; 'resource not found')], 404);
 }
 
 return parent::render($request, $exception);
 }

 // ...
}
</code></pre>
FYI if you just add the AuthorizationException by using the following statement
<blockquote>
use AuthorizationException;
</blockquote>
It still not working. So we have to specify the fully qualified namespace path.

I am trying to develop a RESTful API with Laravel 5.2. I am stumbled on how to return failed authorization in JSON format. Currently, it is throwing the 403 page error instead of JSON.

Controller: <code>TenantController.php</code>

<pre><code>class TenantController extends Controller
{
 public function show($id)
 {
 $tenant = Tenant::find($id);
 if($tenant == null) return response()-&gt;json(['error' =&gt; "Invalid tenant ID."],400);
 $this-&gt;authorize('show',$tenant);
 return $tenant;
 }
}
</code></pre>

Policy: <code>TenantPolicy.php</code>

<pre><code>class TenantPolicy
{
 use HandlesAuthorization;
 public function show(User $user, Tenant $tenant)
 {
 $users = $tenant-&gt;users();
 return $tenant-&gt;users-&gt;contains($user-&gt;id);
 }
}
</code></pre>

The authorization is currently working fine but it is showing up a 403 forbidden page instead of returning json error. Is it possible to return it as JSON for the 403? And, is it possible to make it global for all failed authorizations (not just in this controller)?

How to return 403 response in JSON format in Laravel 5.2?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我正在尝试用Laravel5.2开发一个RESTful API。我无意中发现了如何以JSON格式返回失败的授权。目前，它正在抛出403页错误，而不是JSON。控制器：TenantController.phpclass TenantController extends Controller{    public func...

问如何在Laravel5.2中返回JSON格式的403响应？
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在Laravel5.2中返回JSON格式的403响应？EN