How to validate object ownership in Laravel · vanrossum.dev    

       vanrossum.dev 

 Article

How to validate object ownership in Laravel
===========================================

 ![](https://vanrossum.dev/images/jeffrey-portrait.webp) By Jeffrey van Rossum

  vanrossum.dev  

  [      vanrossum.dev ](https://vanrossum.dev)                      

  [ ← Writing ](https://vanrossum.dev/posts)   [ ← Writing ](https://vanrossum.dev/posts) [ An example use case ](#an-example-use-case) [ Using findOrFail in your controller function ](#using-findorfail-in-your-controller-function) [ Using a Closure ](#using-a-closure) [ Using a custom validation rule ](#using-a-custom-validation-rule) [ In closing ](#in-closing) 

There are several ways in which you can determine if a user owns an object in your Laravel application. This post will give you a couple of examples how you could implement this check within your form request validations.

An example use case
-------------------

Let's take this example use case: a user creates an order and assigns it to a customer through a web form. However, one could abuse the form and alter the customer\_id to a customer that doesn't belong to the current user.

Using findOrFail in your controller function
--------------------------------------------

The simplest way to prevent this from happening is to lookup the customer on the user customers relation. This is assuming you have a hasMany relation on your User model for customers.

```php
auth()->user()->customers()->findOrFail(request('customer_id'));

```

Now when the customer is not found, it will result in a 404 error. This is a solid way, but it doesn't provide feedback to the user and isn't handled within the validation rules. Let's look at how we could do that.

Using a Closure
---------------

If you need this sort of validation only once, you could implement this in your validation [using a Closure](https://laravel.com/docs/6.*/validation#using-closures). That would look like this:

```php
request()->validate([
    'customer_id' => [
        'required', 
        function ($attribute, $value, $fail) {
            if (auth()->user()->customers()->where('customers.id', $value)->doesntExist()) {
                $fail($attribute.' does not belong to you.');
            }
        },
    ]
]);

```

Using a custom validation rule
------------------------------

Now if you need this sort of check multiple times throughout your application, you could best make use of a [Rule object](https://laravel.com/docs/6.*/validation#custom-validation-rules). You can create one by running the following artisan command.

`php artisan make:rule Ownership`

This class will be created within your `app/Rules` directory. In this example, the Ownership rule will accept a model (string or instance) as parameter. Then we will try and find that instance of the model and check if the model's `user_id` is the same as the current user's id.

```php
class Ownership implements Rule
{
    protected $model;

    public function __construct($model)
    {
        $this->model = $model;
    }

    public function passes($attribute, $value)
    {
        $object = is_object($value) ? $value : (new $this->model)->findOrFail($value);

        return $object->user_id === auth()->id();
    }

    public function message()
    {
        return 'This object does not belong to you.';
    }
}

```

Sometimes you might not use the `user_id` column but maybe something like `owner_id`. You could make that changeable by adding an additional parameter for this column name to the constructor.

Now to implement this in your validation rules, you can do the following:

```php
request()->validate([
    'customer_id' => ['required', new Ownership('App\Customer')]
]);

```

In closing
----------

I think all options are fine and there might even be better solutions. If you use one of the solutions in this post, the one you should use depends on whether you would want to display a validation message and if you find yourself doing this type of check multiple times.

  ![](https://vanrossum.dev/images/jeffrey-portrait.webp) Jeffrey van Rossum [@jeffreyrossum](https://x.com/jeffreyrossum) 

 share [𝕏](https://twitter.com/intent/tweet?url=https%3A%2F%2Fvanrossum.dev%2Fposts%2Fhow-to-validate-object-ownership-in-laravel&text=How+to+validate+object+ownership+in+Laravel) [WhatsApp](https://wa.me/?text=How+to+validate+object+ownership+in+Laravel+https%3A%2F%2Fvanrossum.dev%2Fposts%2Fhow-to-validate-object-ownership-in-laravel) [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fvanrossum.dev%2Fposts%2Fhow-to-validate-object-ownership-in-laravel) 

   © 2026 Jeffrey van Rossum 

  vanrossum.dev vanrossum.dev