Laravel Missing Authorization: How to Add Policy and Gate Checks to Controllers

The Problem

How to Fix

1. 1

   Create a policy for each model

   Generate policies for models that need access control:

   php artisan make:policy PostPolicy --model=Post

   // app/Policies/PostPolicy.php
   public function update(User $user, Post $post): bool
   {
       return $user->id === $post->user_id;
   }

   public function delete(User $user, Post $post): bool
   {
       return $user->id === $post->user_id;
   }

   public function create(User $user): bool
   {
       return true; // Any authenticated user can create
   }

2. 2

   Apply authorization in controllers

   Use the authorize() method or Gate facade:

   // Using authorize() — throws 403 if denied
   public function update(Request $request, Post $post)
   {
       $this->authorize('update', $post);
       // ... update logic
   }

   // Using middleware for all actions
   public function __construct()
   {
       $this->authorizeResource(Post::class, 'post');
   }

   // Using Gate directly
   if (Gate::denies('update', $post)) {
       abort(403);
   }

3. 3

   Scope queries to the authenticated user

   In addition to policies, scope database queries to prevent data leakage:

   // WRONG — returns any user's post
   $post = Post::findOrFail($id);

   // RIGHT — only returns the authenticated user's post
   $post = auth()->user()->posts()->findOrFail($id);

   // Or use a global scope
   class Post extends Model
   {
       protected static function booted()
       {
           static::addGlobalScope('owned', function (Builder $builder) {
               if (auth()->check()) {
                   $builder->where('user_id', auth()->id());
               }
           });
       }
   }

How to Verify

# Get User B's post ID, then try to update it as User A
curl -X PUT https://yourapp.com/api/posts/123 \
  -H 'Authorization: Bearer USER_A_TOKEN' \
  -d 'title=Hacked'

Prevention

Frequently Asked Questions