title: What is the purpose of the authorize method in a Request class in Laravel?
body: <p>I am today in bit confusion about my website security and some extra code that is written to make the website secure. Below are 2 locations where security is applied.</p>
  
  <p><strong>Inside Route Config, To secure the route, I have used Middleware to check the user role.</strong></p>
  
  <pre><code>Route::group(['middleware' =&gt; ['web', 'SuperAdmin', 'auth']], function () {
      Route::get('/Create-Department', 'DepartmentController@CreateDepartment');
  });
  </code></pre>
  
  <p>I mentioned 2 <code>Middlewares</code>.</p>
  
  <blockquote>
    <ol>
    <li><code>Auth Middleware</code>   : This is for <code>authentication</code>. </li>
    <li><code>SuperAdmin Middleware</code>: This is for <code>Authorization</code>.</li>
    </ol>
  </blockquote>
  
  <p><strong>Second location is Request class. Here is the code. In authorize method, again same thing is being checked as already done in route</strong></p>
  
  <pre><code>class DepartmentRequest extends Request
  {
      public function authorize()
      {
          if(\Auth::user() == null) {
              return false;
          }
          if(\Auth::user()-&gt;isSuperAdmin()) {
              return true;
          }
          return false;
      }
  
      public function rules()
      {
          return [
              'Department' =&gt; 'required',
          ];
      }
  }
  </code></pre>
  
  <p><strong>Question:</strong> Should I remove check in Request class? Is that an unwanted validation to secure the request ? As route.config is already doing the job.</p>
  
  <p><strong>What's the use of authorize method? I meant, I am using Request class to validate form inputs. Should I always return true from authorize method?</strong></p>