> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: Type Coercion in Broadcast Routes!
- URL: https://securinglaravel.com/security-tip-type-coercion-in-broadcast-routes/
- Published: 2025-02-16T06:00:50.000Z
- Updated: 2025-02-16T06:00:49.000Z
- Description: [Tip #104] It's easy for type juggling to sneak into authorisation callbacks, especially when types are ambiguous, and if you're not careful, you may be leaving a massive hole waiting to be exploited! 😱
- Author: Stephen Rees-Carter
- Tags: Security Tips, Type Juggling, Authorisation, Audits Top 10, Routing

💡

**We're digging into the weaknesses identified in the updated* [**Laravel Security Audits Top 10*](https://securinglaravel.com/tag/audits-top-10/) *list for 2024\. This week we're looking at* ***#5 Missing or Insufficient Authorisation!**

This week's security top could easily have fit into last week's [In Depth: Common Authorisation Failures!](https://securinglaravel.com/in-depth-common-authorisation-failures/), however I wanted to feature it specifically because of how subtle and dangerous this one is.

Take a good look at this code, is there anything wrong with it?

```php
Broadcast::channel('users.{id}', function (User $user, $id) {
    return (bool) $user->id == $id;
});
```

routes/channels.php

I asked this question over on the various socials, so if you'd like to see other peoples thoughts or jump in on the game before reading on, go do that now at [BlueSky](https://bsky.app/profile/valorin.bsky.social/post/3li3wa3m4xw2x?ref=securinglaravel.com), [Mastodon](https://phpc.social/@valorin/113999349390860081?ref=securinglaravel.com), [Twitter](https://x.com/valorin/status/1890192659798528077?ref=securinglaravel.com) and [LinkedIn](https://www.linkedin.com/feed/update/urn:li:activity:7295958455859781632/?ref=securinglaravel.com).

**Ok, are you ready for the answer?**

I can see three issues with this code. The first two are comparatively minor, while the third is a massive problem. *(Yes, I am going to draw this out!)*

### Issue #1: `$id` has no type hinting.

It is completely ambiguous what type `$id` is. The app uses numeric IDs, so it *should* be an integer, but it is also extracted from the string route name. So it *could* be a string... It's really not clear.

Either type hint it in the declaration, or in the conditional when you use it. 

```php
Broadcast::channel('users.{id}', function (User $user, int $id) {

```

Or you could follow a suggestion from my friend Sam Levy, who suggests type-hinting it as `User $id`, and you should get the whole model injected.

```php
Broadcast::channel('users.{id}', function (User $user, User $id) {

```

Alongside this, you should ensure your `User` model returns `$user->id` as an integer as well. This is helpful for Issue #2...

### Issue #2: That's a Loose Comparison!

The code uses `==` to compare the two values, allowing them to be [coerced/juggled](https://securinglaravel.com/tag/type-juggling/) into different types! Given you're dealing with values which may be strings **or** integers, there is some ambiguity that could allow for coercion here. 

```php
$user->id === $id
```

That said, if you're on PHP 8.x *(and you* [*really should be*](https://securinglaravel.com/security-tip-do-you-have-an-upgrade-plan/)*)* then the type juggling possibilities are very limited here. Comparing strings vs integers now convers to strings, which makes this pretty difficult to exploit - given your only input is delivered as a string.

Which is why I described issues #1 and #2 as "comparatively minor" issues, #3 however:

### Issue #3: `(bool)` overrides the comparison into `true == <value>`!

The real issue here is that `(bool)` doesn't apply to the full result of the comparison, instead it applies to the **left side** of the comparison!

Let's add some brackets so it's incredibly obvious what's happening:

```php
return ( (bool) $user->id ) == $id;
```

Since `$user->id` will always be a non-zero integer, it is casted to `true`:

```php
return true == $id;
```

And since `$id` is also a non-zero integer, when referencing real user account, it is also `true`:

```php
return true == true;
```

You can authenticate as **any user** when subscribing to private broadcast channel messages. 😱

For example, in the following screenshot I am logged in as *User #12* and have been automatically subscribed to the private `users.12` channel.

To subscribe to *any other user's* private channel, all I had to do was go into the browser console, type `Echo.private('users.1');`, and I'm in.

![](https://storage.ghost.io/c/d9/0d/d90de76f-6031-4e2c-85b8-3447a38c4992/content/images/2025/02/image-2.png)

Subscribing to to other user's broadcast messages.

Yep, it's that easy... 

![](https://storage.ghost.io/c/d9/0d/d90de76f-6031-4e2c-85b8-3447a38c4992/content/images/2025/02/MinionMicdropGIF.gif)

---

***If you found this security tip useful,*** [***subscribe***](#/portal/signup) ***to get weekly*** [***Security Tips***](https://securinglaravel.com/tag/tips/) **straight to your inbox.* Upgrade to a* [*premium subscription*](#/portal/signup) *for exclusive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*, or drop a coin in the* [*tip jar*](#/portal/support) *to show your support.*

*When was the last time you had a penetration test? Book a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com)*, or a budget-friendly* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*!* 

*You can also connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*, and check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*