阻止经过身份验证的用户查看Laravel 5上的其他用户配置文件

Question

I want to use Laravel 5 AuthServiceProvider to prevent logged in user to view other users profile. I'm using route like this user/1 . How can I compare if the logged in user ID is match with the ID in the URL. If not then can't proceed.

Here's the following code I'm trying in my AuthServiceProvider :

$gate->define('view-profile', function($user, $id) {
    return Auth::user()->id === $id;
});

However, the above code doesn't work as I can't pass the correct ID from the URL. Can anyone please help?

Here's the code I've in my controller:

if (Gate::denies('view-post', [Auth::user()->id, (int) $id])) {
        return abort(403);
    } else {
        return 'success';
}

Answer 1

Just to let all of you know that I've figured it out myself using Gate::forUser() method. Here's the relevant code which I hope anyone may find helpful:

In AuthServiceProvider :

$gate->define('view-post', function($user, $id) {
    return $user->id === (int) $id;
});

In your particular Controller :

$user = Auth::user();

if(Gate::forUser($user)->allows('view-post', $id)) {
    return 'true';
}

return abort(403, trans('Sorry, not sorry!'));

Answer 2

If you route user controller with user, then user/1 will route the user controller show function, and in show function you can check your authentication user with id:

Function show ($id)
{
if (  Auth::user()->id == $id) {
//your code here
}

}