php - Laravel - Allow only the owner of the note to view it and edit it: Middleware or FormRequests? -

imagine personal notes app. users can add, view , edit own notes, not notes belong other users.

the notes accessed way: app.dev/notes/{id}

so naturally, if own note has id of 140, change id 160 in url, able view note.

i want prevent happening. thought of using middleware this, i've read people saying shouldn't use middleware because isn't flexible, , should use formrequests instead.

the problem is, don't understand how use formrequests in case. i've used formrequests prevent user editing note doesn't belong them. if own note id of 140, , try edit/post note id of 160, form request won't let me it.

but formrequest doesn't prevents me viewing note id of 160.

can please point me right way of doing this?

thank you

you can use policy. cleaner , easier way authorization.

authorization policy : laravel

after creating , registering policy can

public function access(user $user, note $note)  {      return $user->id === $note->user_id;  }  

then in method

if (!$user->cannot('access', $note))  {      // throw error or redirect somewhere else  }