Laravel: How to protect resources from access by other users?

Question

I'm wondering how to protect resources from access by other users with Laravel.

For example if I have this scenario:

• User 1 has a resource with id 1
• User 2 has a resource with id 2

how can I protect access of resource 2 from user 1?

An example is accessing a resource for edit via this URL:

http://localhost:8000/resource/2/edit

Does Laravel has a feature to do that or should I manually check the ownership in every Controller's method?

Thanks in advance.

Answer 1

You can create policy for that :

public function update(User $user, Resource $resource)
{
    return $user->id == $resource->user_id; //for example
}

then you can add it as middleware to your edit route :

Route::get('resource/{resource}/edit', ResourceController@edit)->middleware('can:update,resource');

Ps: that's just an example in the documentation there are many usful things that can help you