How to Resolve a Conflict Between Sessions and Encrypted IDs in Laravel?

@jlrdw thank you for responding

Yes, it is necessary because putting the ID (in numeric format) as a parameter in the URL is not a good practice.

For example: http://localhost/user/1/edit

@paulaomsg Sure. No one is disputing that. But adding a getIdAttribute accessor to your model is not the way to achieve this, as that’s going to have knock-on effects anywhere the ID is requested—which you’ve found.

You should instead consider routing using a “pseudo” attribute:

Route::get('/users/{user:encrypted_id}', [UserController::class, 'show']);

You can then implement the resolveRouteBinding method in your model that looks for this attribute name (encrypted_id) and does the problem decrypting of the value and query:

class User extends Authenticatable
{
    public function resolveRouteBinding($value, $field = null)
    {
        if ($field === 'encrypted_id') {
            $id = decrypt_string($value);

            return static::query()->findOrFail($id);
        }

        return parent::resolveRouteBinding($value, $field);
    }
}

This will stop your application throwing exceptions when trying to use the value of $user->id.

Alternatively, you could just use something like Sqids (formerly known as Hashids):

Route::get('users/{user:sqid}', [UserController::class, 'show']);

class User extends Authenticatable
{
    public function getSqidAttribute(): string
    {
        $sqids = new Sqids();

        return $sqids->encode([$this->getKey()]);
    }

    public function resolveRouteBinding($value, $field = null)
    {
        if ($field === 'sqid') {
            $sqids = new Sqids();

            $ids = $sqids->decode($value);

            return static::query()->findOrFail($ids[0]);
        }

        return parent::resolveRouteBinding($value, $field);
    }
}

If you went this route, I’d wrap those two methods up in a HasSqid trait that you can then apply to multiple models you wish to support routing via Sqids. This way, you can just carry on generating routes as normal:

Route::get('users/{user:sqid]', [UserController::class, 'show'])->name('user.show');

<!-- Below will use 'sqid' attribute as defined in route -->
<a href="{{ route('user.show', compact('user')) }}">View user details</a>

@martinbean Sensational, indeed a perfect approach! But first, I want to apologize to @jlrdw in case I didn’t understand him correctly. After martinbean’s explanation, it made me reflect on it…

Back to the solution… I wasn’t aware of these "pseudo" attributes, and now your approach makes total sense.

In my case, I used Sqids, and I thought it turned out more interesting.

Thank you all so much for your dedication and time in helping me.

@martinbean This solution worked perfectly, but when adding a second parameter, it stopped working. Example:

Route::get('invoice/{user:sqid}/address/{address:sqid}', [UserController::class, 'show'])->name('user.show');

Of course, this route doesn’t make much sense, but just to illustrate.

It would return an error like:

Column not found: 1054 Unknown column 'address.sqid'

I spent the whole day trying to solve it... I added another name, e.g., sqid2, but nothing worked...

@JussiMannisto

I understand, thank you for responding.

I would say practicality, since I have tools that do the job automatically, in a simpler way, and ensure greater interoperability, as they are native to Laravel. See, it seems very sensible to use:

route('example.edit', $model);

And then:

public function edit(Model $model) { ... }

My knowledge of Laravel is somewhat limited, but in my understanding, getIdAttribute() and resolveRouteBinding() are methods that we can use to solve these types of issues, since passing the ID without processing it in the URL isn't ideal.

Now... is there a more efficient native way to do this? I don't know...

I think creating a column in the database just to store an encrypted ID could have some side effects. It could slow down the query, and we'd have to ensure that id_encrypted is the same as ID, etc...

On the other hand, using id_encrypted just as a parameter could make the code repetitive and more complex.

For example:

route('example.edit', ['id_encrypted' => encode($model->id)]);

Then

public function edit(string $id_encrypted) {
    $model = Model::find(decode($id_encrypted));
}

Now, if there is a better way to do this, I would be very happy to learn.