Laravel 2 min read
Authorize an invoice before accepting its update
An authenticated user changes an invoice ID in the address bar. Login proves who the user is; it does not prove that this invoice belongs to them. Put the ownership rule in the app...