Laravel authorization and validation

Laravel Authorization & Validation

Form Request validation and mass assignment

• Validate incoming input in dedicated FormRequest classes (rules(), authorize(), custom messages), following the project's rule format (array or pipe-delimited, Rule::enum(), Rule::exists()->where(...) scoped to the current tenant).
• Pass only $request->validated() or $request->safe()->only([...]) to create(), update() or fill(). Never pass $request->all(), $request->input() or $request->except() into mass assignment.
• Keep sensitive attributes (role, is_admin, tenant_id, user_id, balance, status) out of $fillable or set them explicitly on the model from verified server context.

Policies, Gates and tenant isolation

• Enforce authorization on the server for every mutated or read resource via Policies ($this->authorize(), Gate::authorize(), ->can() route middleware). Never trust tenant_id, user_id, ownership or roles sent in the request payload.
• Scope nested route model bindings with ->scopeBindings() so child records cannot be accessed across parent resources.
• Never treat an Eloquent global scope alone as complete authorization: verify how tenant and user context are resolved in HTTP requests, CLI commands and queued jobs, and check Policies explicitly.

Query and output safety

• Never interpolate user input into whereRaw(), selectRaw(), orderByRaw() or DB::raw(); always pass bindings (whereRaw('price > ?', [$min])) and whitelist column and direction names before orderBy().
• Keep Blade {{ $value }} escaping; use {!! $html !!} only for sanitized, trusted HTML. Ensure @csrf and throttle: rate limiters protect state-changing and auth routes.