title: Laravel only allow owner user to access route
body: <p>I have an application that has users and products. Only the product owners should be able to view the product. </p>
  
  <p>If a user guesses a product id they might be able to view the product. For example</p>
  
  <pre><code>http://booker.app/admin/products/32
  </code></pre>
  
  <p>Following that link would allow any logged in user to view the product with id 32.</p>
  
  <p>This is the route in question:</p>
  
  <pre><code>Route::middleware(['middleware' =&gt; 'auth'])-&gt;prefix('admin')-&gt;group(function(){
      Route::resource('products', 'ProductController');
  });
  </code></pre>
  
  <p>My products controller show method:</p>
  
  <pre><code>public function show(Product $product)
  {        
      if($product-&gt;user_id !== Auth::user()-&gt;id){        
          return $this-&gt;forbidden('admin/products');
      }
  
      return $this-&gt;makeResponse('admin.products.product', compact('product'));
  }
  </code></pre>
  
  <p>The forbidden and makeResponse functions simply check if the request was an ajax request and if so returns json.</p>
  
  <p>As you can see I'm using route model binding and I'm checking if the authorised user is the same as product  user_id. Basically is there a better way of checking if the user is the owner of the product.</p>