I'm creating an application which allows users to register an account. Once signed in, they can then create as many "Clients" as they want.
My issue is that resourceful coding means that the urls for viewing/editing will use the primary key, and that if for example, user 1 creates clients 1, and 2. Then another user creates some more, the next id for user 1 would be 5 for example.
Is this exposure ok? confusing to the user? and if not, how would you fix it? I've seen TinyPHP for obfuscation.
Thanks!
It should not be, if you are careful. Make sure you do not allow users to edit clients that are not theirs. Before edit or delete, check if that client belongs to the user that is making the edit/delete.
Yeah i've been sure to check that with $user->clients()->findOrFail($id); before any form of action.
I've also been thinking about composite keys as alternative method to this.
Your url should not be like : something.com/1/113/edit.
Rather clear like : someting.com/manager/1/client/113/edit
Sign in to participate in this thread!
Laravel
Laravel News
Laracasts
Laravel Podcast