---
title: "Discussion on \"How to secure model ID’s in Livewire and why this is important\" | Hashnode"
description: "Discussion on \"How to secure model ID’s in Livewire and why this is important\". TL;DR\nThere is a way to protect your public properties in Livewire 2 in the way it will work in the upcoming Livewire 3. There is a Trait at the end of the article you can use for this.\nWhy should you protect model ID's in Livewire\nLivewire is great!..."
url: "https://hashnode.com/posts/how-to-secure-model-ids-in-livewire-and-why-this-is-important/63dfcae0607038ab00b91ba6"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [How to secure model ID’s in Livewire and why this is important](https://stefrouschop.nl/how-to-secure-model-ids-in-livewire-and-why-this-is-important?utm_source=hashnode&utm_medium=feed)

TL;DR There is a way to protect your public properties in Livewire 2 in the way it will work in the upcoming Livewire 3. There is a Trait at the end of the article you can use for this. Why should you protect model ID's in Livewire Livewire is great!...

Feb 5, 2023 · 5 min read · stefrouschop.nl  
Updated Feb 6, 2023  
Read the article

-   [#livewire](https://hashnode.com/tag/livewire)
-   [#laravel](https://hashnode.com/tag/laravel)
-   [#security](https://hashnode.com/tag/security)

## Written by

[Stef Rouschop](https://hashnode.com/@stefrouschop)

@stefrouschop · Ulestraten, The Netherlands

  
[View profile](https://hashnode.com/@stefrouschop)

Laravel Developer at Code Runway B.V.

Lead developer at 3rdRisk.com. Proud father of two kids. Tech optimist. Apple and Laravel enthusiast.

## Responses 3

Markdown supported · ⌘↵ to post

[Ruben van Erk](https://hashnode.com/@rubenvanerk)

[Mar 1, 2023](https://hashnode.com/posts/how-to-secure-model-ids-in-livewire-and-why-this-is-important/63dfcae0607038ab00b91ba6/comment/63ffa7da2b647366da4d64fe)

Wouldn't `$this->authorize('update', $post)` in the save method prevent you from tampering with posts you're not authorized to update?

[Stef Rouschop](https://hashnode.com/@stefrouschop)

[Mar 1, 2023](https://hashnode.com/posts/how-to-secure-model-ids-in-livewire-and-why-this-is-important/63dfcae0607038ab00b91ba6/comment/63ffa7da2b647366da4d64fe#reply-63ffaa814afe53670a9e0e5a)

Yes it does. That’s why I included it, it’s more like a double check. Depending on the project, the auth policy can differ. In some weird cases, a user could return true to a policy (is in the same team, etc.) and you still do not want them to tamper with the ID. In that case the lock would be helpful. Also, the ID is just an example. For example, you could also lock a variable that contains an action type like ‘create’ or ‘update’. A public variable can be useful for something like this, and you don’t want users to tamper with that.

[Ruben van Erk](https://hashnode.com/@rubenvanerk)

[Mar 1, 2023](https://hashnode.com/posts/how-to-secure-model-ids-in-livewire-and-why-this-is-important/63dfcae0607038ab00b91ba6/comment/63ffa7da2b647366da4d64fe#reply-63ffad624afe53670a9e0ea6)

Makes sense, thanks for the swift reply!

Also, just a heads-up: Livewire 3 will probably use an attribute like #\[Locked\] for it

[Stef Rouschop](https://hashnode.com/@stefrouschop)

[Mar 1, 2023](https://hashnode.com/posts/how-to-secure-model-ids-in-livewire-and-why-this-is-important/63dfcae0607038ab00b91ba6/comment/63ffa7da2b647366da4d64fe#reply-63ffaf414afe53670a9e0ee2)

[Ruben van Erk](https://hashnode.com/@rubenvanerk) you’re welcome! Yes, I noticed Caleb was still in doubt how the attribute is going to be. But a find and replace in the code base isn’t that much of a hassle 😉.

[Bardhyl Fejzullahu](https://hashnode.com/@bardh7)

[Feb 8, 2023](https://hashnode.com/posts/how-to-secure-model-ids-in-livewire-and-why-this-is-important/63dfcae0607038ab00b91ba6/comment/63e421b4c12298e89c7150b4)

I thought this is handled automatically via checksum. From livewire documentation v2 (cannot paste the link):

The Checksum The fundamental security underpinning Livewire is a "checksum" that travels along with request/responses and is used to validate that the state from the server hasn't been tampered with in the browser.

[Stef Rouschop](https://hashnode.com/@stefrouschop)

[Feb 9, 2023](https://hashnode.com/posts/how-to-secure-model-ids-in-livewire-and-why-this-is-important/63dfcae0607038ab00b91ba6/comment/63e421b4c12298e89c7150b4#reply-63e499c09870a6e797804d3c)

Yes, there is a checksum. But that is the point. If you would change the value through the "wire" by using `$0.__livewire.$wire.postId = 5` the checksum will be recalculated because this is a legit action because $postId is a public property. Only if you would do something like `$0.__livewire.data.postId = 5` the checksum would fail as soon as you click save.

[Bardhyl Fejzullahu](https://hashnode.com/@bardh7)

[Feb 9, 2023](https://hashnode.com/posts/how-to-secure-model-ids-in-livewire-and-why-this-is-important/63dfcae0607038ab00b91ba6/comment/63e421b4c12298e89c7150b4#reply-63e4b70fd0024cf4f3e75c8b)

[Stef Rouschop](https://hashnode.com/@stefrouschop) got it. Thanks

[Bardhyl Fejzullahu](https://hashnode.com/@bardh7)

[Feb 8, 2023](https://hashnode.com/posts/how-to-secure-model-ids-in-livewire-and-why-this-is-important/63dfcae0607038ab00b91ba6/comment/63e4212fc12298e89c715098)

Great article.