Level 102
Why send it at all? Just find it in the controller.
If it is important that the user can't see it, then don't put it client side.
Oct 29, 2021
22
Level 2
Hiding request data.
I have a form that I would want to submit to a 'GET' endpoint that retrieves some information from an external API. The user should only see the 'title' field in the url but pass through a unique id to the route/controller that will use it to call the APi.
Example URL:
resource/item-title✅
While the route/controller receives the id, I haven't found a way to hide this parameter, since GET requests show all parameters in the URL.
IE -> resource/item-title/jfe893j3921j ❌
I have tried to create a ''POST' endpoint instead which does the job(via hidden input), but have ran into another issue since the post controller handler returns a view and every time the user refreshes they are prompted with another post re submission request. Ideally I would like to return this same page on refresh just without prompting a re submission.
Also direct 'GET' requests to the endpoint 'resource/item-title' should return a 404 since no 'id' has been passed. Is there way around this/best practices?
Level 2
@Sinnbeck So I have a search page that returns a list of items. Each item has a corresponding form with a button that routes to /resource/item-title. I need to pass in the ID of each item in each form or else I won't be able to call an API to get info on that item once the user clicks on that item to view more information on it.
Level 2
Also I do not persist any item information server side. I just get the data and display it.
Level 102
@electric18 ok so why not just have it in the url? Or use a form with post as you said?
Only way I can find where it is hidden, is to encrypt it in blade, and decrypt it in the controller.
1 like
Level 2
@Sinnbeck Honestly, it was more of an aesthetic thing . I also saw somethings regarding sessions, IE possibly storing it in a session variable, although I don't think that sounds like a great idea? Anyways, I'm just going to with displaying the ID. Thank you for your responses!
Level 102
@electric18 happy to help. But without some sort of local lookup table (eg database), you are out of luck
Level 73
@electric18 Since it sounds like you are calling an api server side to fetch the data you could use a post request to your controller and from there convert it to a get request and hit the api.
Or you can do it on the client side with an ajax call and pass the parameters in the header then they will not be visible in the url.
Level 2
@Sinnbeck Gotcha, I would need some sort of slug to query for the item. Just started learning Laravel so I'm just trying to figure different things out
Level 2
@Tray2 Meaning hit the API and redirect to a separate end point? How would I pass the data?
Level 102
@electric18 no worries. Be aware that often the url does not matter. Depends on context. Try looking at something like Gmail. All urls are unreadable.
Level 2
@Sinnbeck Makes sense. I can always just include the tilte in the attr either way. Thanks again!
Level 73
@electric18 Regardless if the api is hit by the server or the browser it would still be the same thing
Every request you make to one of your controllers will return something if you tell it to do it.
So if you make a post request from your view to the controller and then the controller fetches the data from the api and then returns that data in the response back to your view.
Or if you want to handle it strictly with JavaScript on the client side you can do that using the fetch api and never touch your own back end (pun intended).
It really doesn't matter which way you go but I would probably do it client side since you don't store any of the data locally.
Level 102
@Tray2 be aware that a private api key might be used server-side
Level 2
@Tray2 Honestly client side handling really seems like a good option. I'm planning to incorporate React with Inertia once I become more familiar. Thank you!
Level 2
@Sinnbeck I do have a private API key, although the API does not require it.
Level 102
@electric18 just be sure to never use it client side
Level 2
@Sinnbeck In that case how would JS framworks like React interact with API's, if they required an API key?
Level 102
@electric18 react generally have a backend to handle all that stuff. Like laravel or node
Level 2
@Sinnbeck Ah, ok. TY
Level 102
@electric18 I use inertia with react as well and implement several apis in laravel
Level 73
@Sinnbeck Yes, that is true.
1 like
Level 102
If your question was solved, please consider marking a best answer to set the thread as solved
Please or to participate in this conversation.