What is Difference Between Policy Authorize vs Can Function In Laravel? - php

Question

I'm using laravel basic policy system to protect unauthorized user from update post. For Example User have Id 1 and In posts Table User_id is also 1.
Now in $this->authorize('update',$post); way I can pass only one variable $post to authenticate. while in can method I can also use $user variable $user->can('update',$post) for authorize.
Here is code:
In PostPolicy.php :
public function update(User $user, Post $post)
{
return $user->id === $post->user_id;
}
In AuthServiceProvider.php :
protected $policies = [
Post::class => PostPolicy::class
]
In Controller Authorize way :
public function update(Request $request, $id)
{
$post=Post::find(1);
$user=User::find(1);
$this->authorize('update',$post);
return 'Hello Everything Access For You ';
}
Using can method in Controller :
public function update(Request $request, $id)
{
$post=Post::find(1);
$user=User::find(1);
if($user->can('update',$post)){
return 'Your are allowed';
}
else
{
return 'Your are Not allowed';
}
}
Is I'm right for these two functions. Is there any Difference. Which method I have to use. Thanks in Advance.

Answer 1

If you are using any of authorize() or can(), the purpose is to validate if user is authorized to do certain tasks.
But :
In case of authorize(), if it fails(returns false from policy method), the authorize method will throw an Illuminate\Auth\Access\AuthorizationException, which the default Laravel exception handler will convert to an HTTP response with a 403
In case of can(), it like just a basic method to check if user is authorized or not and then you need to handle the rest on your own. Like what to do if its unauthorized.
Considering above factors, I would say $this->authorize('update',$post); is easier to be used in controller.
Check more about the same in documentation
Also you can do :
$request->user()->can() if you want to check authorization of current requesting user.
Update :
authorize() is designed to authorize current user who is logged in, where laravel passes current user automatically to policy.
Whereas you can use can on any user instance.
$request->user()->can() if you want to check authorization of current requesting user.
$user = $user::find($id); $user->can(...) if its any other user

Answer 2

$this->authorize() checks if the current user is authorized. $user->can() checks if the user in $user is authorized. Both rely on the same underlying policy to make the decision.
The main difference between the two is that $this->authorize() throws an exception if the current user isn't authorized (as it's intended for use within a controller), whereas $user->can() just returns true/false.
If you want a controller to act as if it's doing $this->authorize() for a different user than the current one, you can do this:
// where "123" is the user you want to check against
$user = App\User::find(123);
if(!$user->can('update', $post) {
throw new \Illuminate\Auth\Access\AuthorizationException;
}
That said, this is rarely what you want to do - it doesn't (usually) make much sense to determine if the current user can do something based on another user's permissions.