Using policies and guard to protect user pages

Here, I am going to show how we can use gate to keep users from deleting other people's Favorites.

Getting ready

A fresh install of Laravel will do. But if you have followed along this far, you will have all the routes and controllers in place.

How to do it...

1. Using Artisan, we will make a policy as follows:

   > php artisan make:policy FavoriteDeletePolicy
   

2. It will create a file called app/Policies/FavoriteDeletePolicy.php.

3. Then, we register it with the app/Providers/AuthServiceProvider.php class:

   

   Register Policy

4. Now, we update the policy to have delete just as model:

   

5. Then, we will plug the gate into the controller called app/Http/Controllers/FavoriteRemove.php:

   

6. Once this is done, you will see how users are rejected if they do not own Favorite; for a moment, I will update the policy to be this—the opposite of what we really want—just for example:

   

   This is the response that they will get:

   

   Failed Response

7. You will see that it works correctly if we put it back...