---
title: "Comment by Ruben van Erk on \"How to secure model ID’s in Livewire and why this is important\" | Hashnode"
description: "Wouldn't $this->authorize('update', $post) in the save method prevent you from tampering with posts you're not authorized to update?"
url: "https://hashnode.com/posts/how-to-secure-model-ids-in-livewire-and-why-this-is-important/63dfcae0607038ab00b91ba6/comment/63ffa7da2b647366da4d64fe"
---

[Discussion](https://hashnode.com/posts/how-to-secure-model-ids-in-livewire-and-why-this-is-important/63dfcae0607038ab00b91ba6)

Comment [How to secure model ID’s in Livewire and why this is important](https://hashnode.com/posts/how-to-secure-model-ids-in-livewire-and-why-this-is-important/63dfcae0607038ab00b91ba6)

[Ruben van Erk](https://hashnode.com/@rubenvanerk)

[Mar 1, 2023](https://hashnode.com/posts/how-to-secure-model-ids-in-livewire-and-why-this-is-important/63dfcae0607038ab00b91ba6/comment/63ffa7da2b647366da4d64fe)

Wouldn't `$this->authorize('update', $post)` in the save method prevent you from tampering with posts you're not authorized to update?

[Stef Rouschop](https://hashnode.com/@stefrouschop)

[Mar 1, 2023](https://hashnode.com/posts/how-to-secure-model-ids-in-livewire-and-why-this-is-important/63dfcae0607038ab00b91ba6/comment/63ffa7da2b647366da4d64fe#reply-63ffaa814afe53670a9e0e5a)

Yes it does. That’s why I included it, it’s more like a double check. Depending on the project, the auth policy can differ. In some weird cases, a user could return true to a policy (is in the same team, etc.) and you still do not want them to tamper with the ID. In that case the lock would be helpful. Also, the ID is just an example. For example, you could also lock a variable that contains an action type like ‘create’ or ‘update’. A public variable can be useful for something like this, and you don’t want users to tamper with that.

[Ruben van Erk](https://hashnode.com/@rubenvanerk)

[Mar 1, 2023](https://hashnode.com/posts/how-to-secure-model-ids-in-livewire-and-why-this-is-important/63dfcae0607038ab00b91ba6/comment/63ffa7da2b647366da4d64fe#reply-63ffad624afe53670a9e0ea6)

Makes sense, thanks for the swift reply!

Also, just a heads-up: Livewire 3 will probably use an attribute like #\[Locked\] for it

[Stef Rouschop](https://hashnode.com/@stefrouschop)

[Mar 1, 2023](https://hashnode.com/posts/how-to-secure-model-ids-in-livewire-and-why-this-is-important/63dfcae0607038ab00b91ba6/comment/63ffa7da2b647366da4d64fe#reply-63ffaf414afe53670a9e0ee2)

[Ruben van Erk](https://hashnode.com/@rubenvanerk) you’re welcome! Yes, I noticed Caleb was still in doubt how the attribute is going to be. But a find and replace in the code base isn’t that much of a hassle 😉.