browser tabs shared session data causes loading wrong data

@jlrdw Yes, when a different browser is used there is no issue with loading project data. But.. some users open a new tab, load a second project to work on. And then we get issues with the wrong data loading in. That is why we added a new branch where we use database project ID data. But when we use this change everywhere including loading a project we have the issues that the middleware no longer works.

Perhaps we should only use project id check in database for that one method

public static function saveProjectFromJSON($json)
    {
        $attrs = json_decode($json);
        $project = self::find($attrs->id);

        $project->json = json_encode($attrs);

        return $project->save();
    }

and keep using

 public static function getProjectFromSession()
    {
        $projectId = session('currentproject');

        return self::find($projectId);
    }

in other methods for loading the project and so on . Cause now

 axios.get(`/editor/get-pages?project=${PROJECT_ID}`)
                .then(res => {
                    this.$store.dispatch('editor/setPages', res.data.data)
                })
                .catch(() => {});
        },

adds project id as string to url and that string / id I can change and open projects I should not be able to open with that user.

Or we need to block opening another project in another tab somehow showing: you are already working on a project, please save and leave before working on another one... But for that I would also need to see how I could do that.

@Sinnbeck I used

...
Route::prefix('{project}')->middleware('auth', 'subcheck')->group(function () {
        Route::get('get-pages', [Editor\ProjectController::class, 'getPages']);
    });
...

with

...
// Get Pages
    axios.get(`/editor/get-pages`)
        .then(res => {
            this.$store.dispatch('editor/setPages', res.data.data)
        })
        .catch(() => {});
},
...

and the route does load. But I can still change the project id site/editor?project=22 to open a project that does not belong to the current user. So this may work but then my middleware does not prevent this.. Perhaps because it is authentication and not authorization.. But app/Providers/AuthServiceProvider.php does load in and Project policy

class ProjectPolicy
{
    use HandlesAuthorization;

    public function edit(User $user, Project $project)
    {
        return $user->id === $project->user_id;
    }

    public function update(User $user, Project $project)
    {
        return $user->id === $project->user_id;
    }
}

should also work should it not? Then again.. this checks for edit and update, not for direct loading as I do now I guess..

@rhand Uhm you have /{project}/get-pages as the url but you are telling laravel that the project id is editor?

// Get Pages
    axios.get(`/12/get-pages`) //setting the id
        .then(res => {
            this.$store.dispatch('editor/setPages', res.data.data)
        })
        .catch(() => {});
},

@Sinnbeck In the end we were able to keep the routes as it as the get requests. We added this to the _construct(): in the controllers dealing with projects:

...
use Illuminate\Support\Facades\Auth;
...
$this->currentProject = Auth::user()->projects()->findOrFail(request()->project);
...

@rhand authorisation is not just about what actions a user can perform, but also, with which resources.

You can use policies to check ownership of the project so that it is safe to specify in the URL

@Snapey True that we only check whether a user can edit or update a project in the Project policy now. How would adding resource check method or separate policy look like? The Project Controller is no resource controller but a general one dealing with updates, loading and such.