

# Redirect Middlewares

Included in the AuthProvider package are `RedirectMiddleware` and `InverseRedirectMiddleware` classes that will help you redirect unauthenticated or authenticated requests to a given path. This is especially useful for redirecting users away from secure pages to a login page and vice versa.

## Redirect Middleware

Let's take a look at how to add a `RedirectMiddleware` to your application.

### Existing Auth

Since we only want this middleware to apply to secure pages, we'll apply it using route groups.

You should already have a protected area in your application using one of the authentication middlewares.

    import Vapor
    import AuthProvider

    let drop = try Droplet()

    drop.get("login") { req in
        return // some login form
    }

    let auth = TokenAuthenticationMiddleware(User.self)
    let protected = drop.grouped([auth])
    protected.get("secure") { req in
        let user = try req.auth.assertAuthenticated(User.self)
        return "Welcome to the secure page, \(user.name)"
    }

The above snippet protects access to the page at `GET /secure` using the `TokenAuthenticationMiddleware`.

Since we've applied `TokenAuthenticationMiddleware`, this page cannot be accessed by anyone not authenticated. Although this is perfectly secure, we should provide a better experience for unauthenticated users. Instead of just showing them an error message, we can redirect them to the login page.

### Add Redirect

Creating a redirect middleware is very simple. We'll use one of the presets for redirecting a user to `/login`.

    let redirect = RedirectMiddleware.login()

Now we just need to add this redirect middleware to our `protected` route group mentioned previously.

    let protected = drop.grouped([redirect, auth])

Warning

Make sure the redirect middleware comes before the auth middleware.

### Complete Example

Now whenever an unauthenticated user attemps to visit `GET /secure`, they will be redirected to `GET /login`.

    import Vapor
    import AuthProvider

    let drop = try Droplet()

    let redirect = RedirectMiddleware.login()
    let auth = TokenAuthenticationMiddleware(TestUser.self)

    let protected = drop.grouped([redirect, auth])
    protected.get { req in
        let user = try req.auth.assertAuthenticated(TestUser.self)
        return "Welcome to the dashboard, \(user.name)"
    }

### Custom Route

If your login page is not `/login` or you'd like the redirect middleware to redirect to a different type of page, simply use the full initializer.

    let redirect = RedirectMiddleware(path: "/foo")

## Inverse Redirect Middleware

Complementary to the `RedirectMiddleware` is the `InverseRedirectMiddleware`. Just like you want to redirect unauthenticated users away from secure pages, you also might want to redirect authenticated users away from certain pages.

For example, if a user is already authenticated and they visit the login page, they might be confused and attempt to login again.

### Example

Here is an example of the `InverseRedirectMiddleware` being used to redirect authenticated `User`s away from the login page.

We are using the preset `.home()` convenience, which redirects the user to `GET /`.

    import Vapor
    import AuthProvider

    let drop = try Droplet()

    let redirect = InverseRedirectMiddleware.home(User.self)
    let group = drop.grouped([redirect])
    group.get("login") { req in
        return "Please login"
    }

### Custom Route

If your desired page is not `/` or you'd like the inverse redirect middleware to redirect to a different type of page, simply use the full initializer.

    let redirect = InverseRedirectMiddleware(User.self, path: "/foo")