> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: Scoping Bindings
- URL: https://securinglaravel.com/security-tip-scoping-bindings/
- Published: 2022-06-06T00:00:26.000Z
- Updated: 2024-11-21T03:50:30.000Z
- Description: [Tip#23] Because who doesn't love to scope their bindings?
- Author: Stephen Rees-Carter
- Tags: Security Tips, Routing, Authorisation

If you use Laravel’s [Implicit Route Bindings](https://laravel.com/docs/routing?ref=securinglaravel.com#implicit-binding), you’ll most likely end up with a route that looks like this:

```
Route::get(
    '/projects/{project}/plans/{plan}', 
    function (Project $project, Plan $plan) {
        abort_unless($plan->project()->is($project), 404);

        // ...
    }
);
```

While it's easy to validate that the Plan is owned by the Project, you still need to remember to add it to your action, and it can look a bit ugly...

💡

**Most all of the vulnerabilities I’ve discovered have come about because the developer forgot to include a single line of code to perform authentication, authorisation, or validation. Usually with the exact line required already written for another action in the same controller.*

Luckily for us, [Laravel has our backs](https://laravel.com/docs/routing?ref=securinglaravel.com#implicit-model-binding-scoping) (yet again). There is a handy little method in Laravel’s Routing system called `scopeBindings()`, which we can use to tell Laravel to automatically scope implicitly bound models.

Check it out:

```
Route::get(
    '/projects/{project}/plans/{plan}', 
    function (Project $project, Plan $plan) {
        // ...
    }
)->scopeBindings();
```

Laravel will automatically attempt to load the “child” binding from a relationship on the “parent” binding listed before it. In other words, in our example it will look for a matching `Plan` model from the `plans` relationship on the `Project` model. If the child binding isn’t found, it’ll throw a 404.

This is the same behaviour as our code above, but without that ugly `abort_unless()`.

The best bit is, since it’s a route method we can use it in groups too! This solves the “forgetting to add it” problem, since you’ll typically group your routes and automatically add them into our scoped group.

```
Route::scopeBindings()
    ->group(function () {
        Route::get('/projects/{project}/plans/{plan}', ...);
        Route::get('/projects/{project}/plans/{plan}/edit', ...);
        Route::get('/projects/{project}/plans/{plan}/export', ...);
        // ...
});
```

Nice and simple, just the way we love it in Laravel!

---

***If you found this security tip useful,*** [***subscribe***](#/portal/signup) ***to get weekly*** [***Security Tips***](https://securinglaravel.com/tag/tips/) **straight to your inbox.* Upgrade to a* [*premium subscription*](#/portal/signup) *for exclusive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*, or drop a coin in the* [*tip jar*](#/portal/support) *to show your support.*

*Looking for a* [*Laravel Security Audit / Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com)*, or a budget-friendly* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*? Feel free to reach out! You can also connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*. And don’t miss* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*