Options to conceal public properties

#1

I have a full page route component. I have route bound models, and I like the fluidity of auto binding them when I declare them as properties:

class ReviewFormComponent extends Component {

public User $user;
public Booking $booking;

}

What I don’t want is to expose primary key fields and any other sensitive information. I read in docs “Public props are visible to the front end, you SHOULD NOT store sensitive data in them.” Does that include properties of Eloquent models?

Other than specifying fields as ‘hidden’ in the model, do I have another option here?

TIA

#2

Hey, @wrabit
If you want to hide a field you can specify it as hidden in Your Model as you said, deal with them as a public API.

Or you can share just what’s necessary:

....
public function mount(User $user)
{
  $this->name = $user->name;
  $this->email = $user->email;
  $this->avatar  = $user->profilePhoto() 
  // and so on ...
}
#3

Hi @skywalker, in my initial example, how are the model properties made public ?

I’ve tried to get them via the front-end Livewire class and they returned undefined unless specified in $rules.

If this is the only way that they can be made visit then no need to create model hidden rules right?