People searching “Laravel authorize Vue” check the user in the component and leave the controller open. Call authorize before the write and before you render an editor. The policy guide is the policy class. This page is the call.
TL;DR
- authorize() in the controller is the check.
- The Vue button can hide itself later.
- Do not pass
$request->user()->is_adminfrom Vue as a field namedauthorized. - Do not skip
authorizeonupdatebecauseeditalready checked.
The fix#
public function edit(Post $post): Response
{
$this->authorize('update', $post);
return Inertia::render('posts/Edit', [
'post' => $post->only(['id', 'title']),
]);
}A guest or the wrong user gets a 403. Inertia shows its error page. The Edit vue file does not mount, so it does not need a branch for “not allowed” in order to be safe.
The matching policy method is update(User $user, Post $post): bool. Return false, do not abort inside the policy.
What to avoid#
Gotcha
Do not pass $request->user()->is_admin from Vue as a field named authorized. The controller would be trusting the browser. Do not skip authorize on update because edit already checked. They are different requests.
FAQ#
How do I authorize a controller action before the Vue page?
authorize() in the controller is the check. The Vue button can hide itself later.
What goes wrong with Laravel authorize Vue?
Many developers check the user in the component and leave the controller open. Do not pass $request->user()->is_admin from Vue as a field named authorized.
