inertiajs / inertia-laravel

The Laravel adapter for Inertia.js.
https://inertiajs.com
MIT License
1.99k stars 222 forks source link

[2.x] Feat: Add strict model serialization #630

Open RobertBoes opened 1 month ago

RobertBoes commented 1 month ago

With Inertia it's rather common to make a response like the following:

Inertia::render('Users/Edit', [
    'user' => $request->user(),
]);

However, without proper serialization guards this can be quite dangerous, since it's easy to send more data to the frontend than needed. Inertia has no safeguards against this and it would be impossible for Inertia prevent any secret data to be shared with the frontend. However, we can inspect the type of data that is sent to the frontend.

For this reason I propose a Inertia::strictModels() method, inspired by Laravel's Model::shouldBeStrict() (https://laravel.com/api/11.x/Illuminate/Database/Eloquent/Model.html#method_shouldBeStrict). This should be called in a service provider by the developer. Then when it is enabled a fairly basic check is performed;

I always use Eloquent's API resources or Spatie's Laravel Data for data that's sent to the frontend, with this it would be easier to enforce this in projects.