Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[2.x] Feat: Add strict model serialization #630

Open
wants to merge 2 commits into
base: 2.x
Choose a base branch
from

Conversation

RobertBoes
Copy link
Contributor

With Inertia it's rather common to make a response like the following:

Inertia::render('Users/Edit', [
	'user' => $request->user(),
]);

However, without proper serialization guards this can be quite dangerous, since it's easy to send more data to the frontend than needed. Inertia has no safeguards against this and it would be impossible for Inertia prevent any secret data to be shared with the frontend. However, we can inspect the type of data that is sent to the frontend.

For this reason I propose a Inertia::strictModels() method, inspired by Laravel's Model::shouldBeStrict() (https://laravel.com/api/11.x/Illuminate/Database/Eloquent/Model.html#method_shouldBeStrict). This should be called in a service provider by the developer. Then when it is enabled a fairly basic check is performed;

  • If the data is not a model it is allowed, this would include the usage of a JsonResource or Spatie's Laravel Data
  • If it is a model a check is done to make sure either the hidden or visible property is filled

I always use Eloquent's API resources or Spatie's Laravel Data for data that's sent to the frontend, with this it would be easier to enforce this in projects.

@RobertBoes RobertBoes changed the title Feat: Add strict model serialization [2.x] Feat: Add strict model serialization May 27, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant