Sunday, April 2, 2017

How do I authorize a user to only see his own data with a Laravel oauth2 API?

I have created a Laravel (5.2) API with the oauth2 plugin from lucadegasperi. I use the PasswordGrant as grant type. Everything works fine, except that User A can also see the Data from User B. How can I make sure that the users can only get their own data.

e.g. a user with the id 123 can only get data with this url: sumtotal/123



via flo

Advertisement