How to authenticate owner only to view profile editing page

I am trying to redirect the member to their editing page whenever they try to visit others.

Suppose Rick tries to visit Jack's profile editing page, he must redirect to his own editing page.

localhost/profile/edit/rick and similarly Jack would have his own link like this localhost/profile/edit/jack If Rick tries to visit the page localhost/profile/edit/jack he must redirect to localhost/profile/edit/rick

This is controller here

    public function edit(User $user)
    {
        // If statement would be here
        $user = User::find($user->id);
        return view( 'profile.editprofile', compact('user') );
    }

Basically I am trying to stop other members to edit the page. In my app, I see anyone can visit and edit the profile page for them.

Please tell me how to write if a statement in the controller...

Mubeenali

5 years ago

Level 2

Just write your route inside the auth middleware..will solve this.

Mubeenali

5 years ago

Level 2

Route::middleware('auth',function(){
//only-authenticated-users
Route::get('edit/form/{id}','ProfileController@edit');



});

GeordieJackson

5 years ago

Level 18

@webfuelcode

You could do a simple check in your controller such as:

if( auth()->id() != $user->id) {
    redirect('...')
}

However, it would be far better to set up authorization, such as a Gate. See: https://laravel.com/docs/7.x/authorization

webfuelcode

5 years ago

Level 4

@mubeenali Is it the same if I do like this...

Route::get('edit/form/{id}','ProfileCOntroller@edit')->middleware('auth');

Please or to participate in this conversation.