In this episode, we address an important issue with wildcard subdomains in our Laravel app. Right now, any standard page like /dashboard
or /login
can be accessed under any subdomain, which definitely isn't what we want. For example, if a subdomain is only meant to show pages like home
and about
, it's weird (and potentially insecure) for /dashboard
to work there as well.
To solve this, we jump into our routes file and group up the routes we only want to be available on our main app domain. We use Laravel's route grouping feature, checking the app's URL from config, and pull all sensitive routes (like /dashboard
, /login
, etc.) into that group. This means those routes won't be registered for wildcard subdomains anymore—they'll only exist on the main domain.
We also quickly tackle the auth routes, which are often registered via a separate auth.php
routes file. By requiring this file inside our domain-specific group, we make sure routes like /login
are also unavailable under wildcard subdomains. This keeps everything nicely separated and secures our application routes.
Lastly, there's a quick note about third-party packages that might register routes in a different way—you might need to check if and how they let you adjust route domains.
So, after following along, you'll have wildcard subdomains that only show the routes you actually want, making your Laravel app cleaner and more secure!