This episode is for members only

Sign up to access "Custom User Subdomains in Laravel" right now.

Get started
Already a member? Sign in to continue
Playing
07. Disabling wildcard subdomains for app routes

Transcript

00:00
One problem we've got at the moment because we're dealing with wildcard subdomains which we need in order to have any domain or any subdomain valid and then looked up against a user is that we can access any of our standard pages under this. So for example this subdomain should only have the routes home and about. Now because we've got other routes like dashboard which are part of
00:25
the main user's account we can still go over to slash dashboard. Now ask us to sign in because we're within a different subdomain now so the session isn't valid here but we shouldn't be able to access things like dashboard and login and all them other routes in here at the same time. It just does not make sense. So let's go back over to alex.laravelusersubdomains.test
00:48
and let's figure out how we can disable any of these or any of these routes being included within here. Well to do this what we could do is go over and apply a new root domain inside of our routes file. Now this root domain is just going to be from config and it's going to be the app url and then we're going to group this like we did up here but this time we're going to put all of the
01:16
other routes of our application inside of here. Now we'll get to the auth routes in a second that's a little bit different but if we just pull all of these into here what this is now going to do is it's only going to apply these routes to the main url. So now if we go over to here and we go over to slash dashboard it doesn't exist because it's registered under the group just for that url not
01:41
for the wildcard subdomain. So if we now go over to the main app you see it works. Now for things like login that's a little bit different because this is included if we look down here in an auth.php file that exists within our routes under here and you can see that within here we just have all of these root registrations. Let's just see what happens when we require this within this group.
02:07
Let's go over and sure enough it's not found so we can do that very easily and if we head back over to our main app and go over to login you can see that works as well though we were already signed in so it redirected us. Now if you're pulling in third-party packages that register routes this is going to be slightly different so hopefully the packages that you pull in will have a way to
02:27
configure the route specifically so you can get around this. So just something to think about as you're putting that in. Okay so we can come back over to alex.laravel.usersubdomains.test and see our page but we have now disabled all of the other routes from being accessed under this users subdomain.

Episode summary

In this episode, we address an important issue with wildcard subdomains in our Laravel app. Right now, any standard page like /dashboard or /login can be accessed under any subdomain, which definitely isn't what we want. For example, if a subdomain is only meant to show pages like home and about, it's weird (and potentially insecure) for /dashboard to work there as well.

To solve this, we jump into our routes file and group up the routes we only want to be available on our main app domain. We use Laravel's route grouping feature, checking the app's URL from config, and pull all sensitive routes (like /dashboard, /login, etc.) into that group. This means those routes won't be registered for wildcard subdomains anymore—they'll only exist on the main domain.

We also quickly tackle the auth routes, which are often registered via a separate auth.php routes file. By requiring this file inside our domain-specific group, we make sure routes like /login are also unavailable under wildcard subdomains. This keeps everything nicely separated and secures our application routes.

Lastly, there's a quick note about third-party packages that might register routes in a different way—you might need to check if and how they let you adjust route domains.

So, after following along, you'll have wildcard subdomains that only show the routes you actually want, making your Laravel app cleaner and more secure!

Episode discussion

No comments, yet. Be the first!