403 This action is unauthorized Laravel Origin: Application & API Last updated 4 Nov 2026

Laravel: Illuminate\Auth\Access\AuthorizationException: This action is unauthorized.

A policy or gate denied the action for the current user, so Laravel returned HTTP 403.

Exact message you may see This action is unauthorized.Illuminate\Auth\Access\AuthorizationException: This action is unauthorized.403 This action is unauthorized LaravelAuthorizationException This action is unauthorized403 | THIS ACTION IS UNAUTHORIZED
Explore the map of this error Full error map →
Seen on: Laravel PHP

Meaning

$this->authorize('update', $post) or can: middleware asks your policy. Check the policy method (name matches the ability), that the policy is registered (auto-discovered in recent versions), that the user is authenticated, and the policy's logic (ownership/role). Methods returning false/null deny; missing policy for a model denies by default when using authorize.

Common causes

  • Policy method returns false (not owner/role)
  • Policy not discovered/registered
  • Guest user (null) with non-nullable policy method
  • Ability name typo
  • Gate defined in wrong guard

⚡ Quick fix

  1. Debug the policy: Gate::inspect('update', $post)->message()
  2. Register the policy in AuthServiceProvider::$policies if needed
  3. Allow guests with ?User $user type-hint when appropriate

Detailed fix by platform

Laravel

  1. php artisan make:policy PostPolicy --model=Post

How to diagnose

  1. Policy — Method returns?
  2. User — Authenticated?
  3. Registration — Discovered?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Application & API. Errors that are often confused with or caused by this one (click to open):

429 Too Many Requests (Laravel throttle) — Laravel: Illuminate\Http\Exceptions\ThrottleRequestsException: Too Many Attempts. / 429 Too Many Requests (Laravel)429 Too Many Requests…Attempt to read property "x" on null — Laravel/PHP 8: ErrorException: Attempt to read property "name" on null (Laravel)Attempt to read prope…Class "App\Models\X" not found — Laravel: Error: Class "App\Models\Post" not found (Laravel)Class "App\Models\X" …Command "x" is not defined — Laravel: Symfony\Component\Console\Exception\CommandNotFoundException: Command "make:livewire" is not defined. Did you mean one of these? (Laravel)Command "x" is not de…Composer: Allowed memory size exhausted — Composer: PHP Fatal error: Allowed memory size of 1610612736 bytes exhausted (tried to allocate 4096 bytes) in phar:///usr/local/bin/composer (Laravel)Composer: Allowed mem…CORS blocked (Laravel API) — Browser: Access to XMLHttpRequest at 'https://api.example.com' from origin 'http://localhost:3000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header — Laravel (Laravel)CORS blocked (Laravel…DecryptException: The payload is invalid / The MAC is invalid — Laravel: Illuminate\Contracts\Encryption\DecryptException: The payload is invalid. / The MAC is invalid. (Laravel)DecryptException: The…InvalidArgumentException: View [x] not found — Laravel: InvalidArgumentException: View [posts.index] not found. (Laravel)InvalidArgumentExcept…403 This …

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.