telescope: Could not get it to work for non-local environment

in my side, i found the problem was on its Authorization mechanism. so, we can replace it with our own auth mechanisme. now, mine is:

in config/telescope.php

    'middleware' => [
        'web',
        // Authorize::class,
        'admin'
    ],

Remove this from the register function

    Telescope::filter(function (IncomingEntry $entry) {
            if ($this->app->environment() == 'local') {
                return true;
            }

            return $entry->isReportableException() ||
                   $entry->isFailedJob() ||
                   $entry->isScheduledTask() ||
                   $entry->hasMonitoredTag();
    });

The problem appears to be the following method in TelescopeApplicationServiceProvider:

    /**
     * Configure the Telescope authorization services.
     *
     * @return void
     */
    protected function authorization()
    {
        $this->gate();

        Telescope::auth(function ($request) {
            return app()->environment('local') ||
                   Gate::check('viewTelescope', [$request->user()]);
        });
    }

I overrode this method in my TelescopeServiceProvider and defined my own auth closure:

    /**
     * Configure the Telescope authorization services.
     *
     * @return void
     */
    protected function authorization()
    {
        $this->gate();

        Telescope::auth(function ($request) {
            return app()->environment(['local', 'staging']) ||
                   Gate::check('viewTelescope', [$request->user()]);
        });
    }

This allowed me to access telescope in my staging environment. I tried changing my gate() override and it didn’t appear to work. This was the only way that I could reliably get it to work.

Changed the Authorize middleware by my own as following:

class Authorize
{

    /**
     * @param $request
     * @param $next
     * @return mixed
     */
    public function handle($request, $next)
    {
        return $next($request);
    }
}

It fixed the 403 Forbidden on a production server. Used with the removal of the Telescope::filter, it fixed the whole thing for me.

Guys, we’d love to help but we aren’t able to reproduce this.

So, here are some guidelines/checks:

1. Do you see any error logs (backend logs or console frontend errors)?
2. Do you have a Telescope::filter or Telescope::filterBatch call in your App\Providers\TelescopeServiceProvider? If yes, does it satisfy the filter condition? The default TelescopeServiceProvider stub allows all entries to be recorded in local environments but for production only allows reportable exceptions, failed jobs, scheduled tasks and monitored tag entries to be recorded.
3. Did your authorization pass through? The default authorization method in the TelescopeServiceProvider stub always passes for local environments but does the gate check for production.
4. Do you have auto discovery enabled in production? If not, did you add the Laravel\Telescope\TelescopeServiceProvider in your config/app.php?
5. Did you add your App\Providers\TelescopeServiceProvider to your config/app.php?
6. Is telescope enabled in production? Check the env variable TELESCOPE_ENABLED if set. Defaults to true if not set.

If all of these are okay but you’re still facing issues, please share a Github repo with this reproducible issue.

I am not sure if it’s only me or it is a bug but, i think i found the issue. The problem is it doesn’t discover App\Providers\TelescopeServiceProvider::class, So adding App\Providers\TelescopeServiceProvider::class, in config/app.php fixes it. Then i can set in .env file

APP_ENV=production

and in app\Providers\TelescopeServiceProvider.php

  /**
     * Register the Telescope gate.
     *
     * This gate determines who can access Telescope in non-local environments.
     *
     * @return void
     */
    protected function gate()
    {
        Gate::define('viewTelescope', function ($user) {
            return in_array($user->email, [
                "admin@admin.com",
            ]);
        });
    }

then without any issue i can reach /telescope with the user admin@admin.com logged in.

As @glendmaatita says I did a middleware exclusively for telescope // telescope.php

    'middleware' => [
        'web',
        TelescopeMiddleware::class,
        // Authorize::class,
    ],

php artisan make:middleware TelescopeMiddleware

class TelescopeMiddleware
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        
        if(auth()->check() && auth()->user()->email == "punksolid@gmail.com"){

            return $next($request);
        }
        abort(403);
    }
}

@Braunson number 2 seems to be your issue. Your filter is setup to only record reportable exceptions, failed jobs, scheduled tasks or monitored tags in production but will record everything in local. If you remove the Telescope::filter callback, everything should be recorded.

+1 I got 403 Forbidden in Production even if the Gate returns always true

Same here! It works when I use APP_ENV=local.

I tried @dramen solution but It didn’t worked for me.

app.php

'providers' => [

        /*
     * Laravel Framework Service Providers...
     */
        Illuminate\Auth\AuthServiceProvider::class,
        Illuminate\Broadcasting\BroadcastServiceProvider::class,
        Illuminate\Bus\BusServiceProvider::class,
        Illuminate\Cache\CacheServiceProvider::class,
        Illuminate\Foundation\Providers\ConsoleSupportServiceProvider::class,
        Illuminate\Cookie\CookieServiceProvider::class,
        Illuminate\Database\DatabaseServiceProvider::class,
        Illuminate\Encryption\EncryptionServiceProvider::class,
        Illuminate\Filesystem\FilesystemServiceProvider::class,
        Illuminate\Foundation\Providers\FoundationServiceProvider::class,
        Illuminate\Hashing\HashServiceProvider::class,
        Illuminate\Mail\MailServiceProvider::class,
        Illuminate\Notifications\NotificationServiceProvider::class,
        Illuminate\Pagination\PaginationServiceProvider::class,
        Illuminate\Pipeline\PipelineServiceProvider::class,
        Illuminate\Queue\QueueServiceProvider::class,
        Illuminate\Redis\RedisServiceProvider::class,
        Illuminate\Auth\Passwords\PasswordResetServiceProvider::class,
        Illuminate\Session\SessionServiceProvider::class,
        Illuminate\Translation\TranslationServiceProvider::class,
        Illuminate\Validation\ValidationServiceProvider::class,
        Illuminate\View\ViewServiceProvider::class,

        /*
         * Package Service Providers...
         */

        /*
         * Application Service Providers...
         */
        App\Providers\AppServiceProvider::class,
        App\Providers\AuthServiceProvider::class,
        // App\Providers\BroadcastServiceProvider::class,
        App\Providers\EventServiceProvider::class,
        App\Providers\TelescopeServiceProvider::class,
        App\Providers\RouteServiceProvider::class,

        // Agregados por mí.
        crocodicstudio\crudbooster\CRUDBoosterServiceProvider::class,
        App\Providers\TelescopeServiceProvider::class,
    ],

TelescopeServiceProvider.php

protected function gate()
    {
        Gate::define('viewTelescope', function ($user) {
            return true;
            // return \CRUDBooster::isSuperadmin();
        });
    }

This issue is due to an empty or non logged user. Laravel gate receives user as the first argument if it’s empty it doesn’t care about internal code. If you want to use it without gate just remove gate function from TelescopeServiceProvider class and override authorization function. See the example below.

protected function authorization()
{
    $this->gate();

    Telescope::auth(function ($request) {
        return app()->environment('local') ||
               in_array($request->ip(), config('allowed_ip_addresses.telescope'));
    });
}

I removed the gate define as well as gate check, so the issue is resolved.

excuse me I can not connect to the dashboard with a non local env

  public function register()
    {
        // Telescope::night();

        Telescope::filter(function (IncomingEntry $entry) {
           return true;

            return $entry->isReportableException() ||
                   $entry->isFailedJob() ||
                   $entry->isScheduledTask() ||
                   $entry->hasMonitoredTag();
        });
    }

    /**
     * Register the Telescope gate.
     *
     * This gate determines who can access Telescope in non-local environments.
     *
     * @return void
     */
    protected function gate()
    {
        Gate::define('viewTelescope', function ($user) {
            return true;
        });
    }

Changing telescope authorization middleware with laravel’s authentication middleware worked for me. It’s just a workaround.

'middleware' => [
        'web',
       // Authorize::class,
        \App\Http\Middleware\Authenticate::class,
 ],

I can solve it by rewrite authorization method

/**
     * Configure the Telescope authorization services.
     *
     * @return void
     */
    protected function authorization()
    {
        $this->gate();

        Telescope::auth(function ($request) {
            if ($request->get('_token')) {
                $user = PersonalAccessToken::findToken($request->get('_token'))->tokenable;
                return $user->name === 'admin';
            }

            return Gate::check('viewTelescope', [$request]);
        });
    }

Telescope’s gate can run right when Auth::user() had value. So,if you didn’t login,you could not view telescope in production. You can rewrite Authorize::class, like return config('telescope.enabled') ? $next($request) : abort(403);.

in my side, i found the problem was on its Authorization mechanism. so, we can replace it with our own auth mechanisme. now, mine is:

in config/telescope.php

    'middleware' => [
        'web',
        // Authorize::class,
        'admin'
    ],

Thanks, i just comment ‘Authorize::class’

If you’ve been following the instructions in the section “Installing Only In Specific Environments” you’ll need to ensure that you update your AppServiceProvider accordingly, e.g.

public function register()
{
	if ($this->app->environment('local') || $this->app->environment('staging')) {
		$this->app->register(TelescopeServiceProvider::class);
	}
}

I’m having this issue as well now, as of 13 days ago. Requests aren’t being logged (among other things) in a production environment anymore.

+1, can’t connect the dashboard with production env.