# Authorize a controller action before the Vue page

> authorize() in the controller is the check. The Vue button can hide itself later.

- URL: https://laravel-vuejs.space/laravel-authorize-controller-vue
- Author: Anass Ez-zouaine (https://laravel-vuejs.space/author/anass-ez-zouaine)
- Published: 2026-10-11
- Topics: Laravel, VueJs, Permissions

People searching “Laravel authorize Vue” check the user in the component and leave the controller open. Call `authorize` before the write and before you render an editor. The [policy guide](https://laravel-vuejs.space/laravel-vue-policies) is the policy class. This page is the call.

> **TL;DR**
>
> -   authorize() in the controller is the check.
> -   The Vue button can hide itself later.
> -   Do not pass `$request->user()->is_admin` from Vue as a field named `authorized`.
> -   Do not skip `authorize` on `update` because `edit` already checked.
>
> **Who it's for:** Laravel + Vue developers
>
> **Applies to:** Laravel 13 · Vue 3

## The fix

```php
public function edit(Post $post): Response
{
    $this->authorize('update', $post);

    return Inertia::render('posts/Edit', [
        'post' => $post->only(['id', 'title']),
    ]);
}
```

A guest or the wrong user gets a 403. Inertia shows its error page. The Edit vue file does not mount, so it does not need a branch for “not allowed” in order to be safe.

The matching policy method is `update(User $user, Post $post): bool`. Return false, do not abort inside the policy.

## What to avoid

> **Gotcha**
>
> Do not pass `$request->user()->is_admin` from Vue as a field named `authorized`. The controller would be trusting the browser. Do not skip `authorize` on `update` because `edit` already checked. They are different requests.

## FAQ

**Q: How do I authorize a controller action before the Vue page?**

authorize() in the controller is the check. The Vue button can hide itself later.

**Q: What goes wrong with Laravel authorize Vue?**

Many developers check the user in the component and leave the controller open. Do not pass `$request->user()->is_admin` from Vue as a field named `authorized`.