In this episode, we dive into making the export downloading process secure for users. We start by discussing some of the risks involved with storing export files locally and making sure that only their rightful owners should be able to download them. Then, step-by-step, we set up a dedicated download route and controller to handle export downloads.
You'll see how we set up the download functionality and make use of Laravel's storage facade to actually serve the file to the user. But of course, just making a file downloadable by an ID isn't good enough – so we add proper authorization. We go through best practices: adding a form request for the sake of code cleanliness (even when there's no input to validate) and then creating a policy that checks if the logged-in user really owns the export they're trying to download.
To make sure everything works, we also manually test what happens if you try to download someone else's export – and the authorization check kicks in, blocking unauthorized access. Finally, we wrap up by mentioning that we'll improve security later with signed URLs that expire over time, but for now, we have a neat and tidy solution that keeps user data safe.