Laravel REST structuring

Question

I am making a website which will have user login. Login form now leads to admin panel if your role is admin (route is behind admin middleware), and it leads back to home page if your role is user. Back on the home page you have the ability to see your profile page and add a product (which is behind auth middleware).

My question is what is the best approach to form my routes?

If I make site.com/user/{id} route, user ID's will be exposed to each user which logs in, as well as for example editing a product with site.com/user/{id}/product/{product_id}.

I see some security issues here and am wondering if a better solution is making site.com/profile route which will in turn in controller take Auth::user() not exposing ID's in the process?

hazelcodes · Accepted Answer · 2017-06-18 22:30:28Z

1

Add your route without the ID and use Auth::user() It's best practice and makes your routes simpler

Public function profile(){
    $user = Auth::user();
    return view('profile', compact('user');
}

The above code is more straight forward than this:

Public function profile($id){
    $user = User::find($id);
    //prevent authenticated from viewing other users
    if($user == Auth::user()){
         return view('profile', compact('user');
    }else{
        //return something else
    }
}

edited Jun 18, 2017 at 22:30

answered Jun 17, 2017 at 17:47

hazelcodes

9498 silver badges19 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

sebbz · Accepted Answer · 2017-06-17 13:42:54Z

0

If you are worried about exposing user ID you can try use something like hashids, where ID will be encoded.

answered Jun 17, 2017 at 13:42

sebbz

5543 silver badges11 bronze badges

Comments

CIZO · Accepted Answer · 2017-06-17 13:44:12Z

0

Here you go:

encode the id and product_id with base64_encode()

Example pass the id and product_id in url by encoding with base64_encode() and when you want to use it use like this:

Route::get('user/{id}/product/{product_id}', function($code){
     $id = base64_decode($id);
     $product_id = base64_decode($product_id);
});

answered Jun 17, 2017 at 13:44

CIZO

4,1671 gold badge25 silver badges25 bronze badges

1 Comment

user1897253 Over a year ago

So how is using base64 a better solution for the OP's "security issue"?

Collectives™ on Stack Overflow

Laravel REST structuring

3 Answers 3

Comments

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related