In our last lesson, we left off with the ability for users to be able to send messages to each other in real time. But there is one problem that we left behind, which we're going to work on during the course of this lesson. Now, over here in the window on the left, I'm logged in with a User who should have access to the general channel, and over here on the right, you can see this User hasn't joined the channel. But there's one problem here. If I go ahead and refresh that page and click on the WebSockets tab, you can see that I'm able to subscribe to the channel with ID of 1, which in this case happens to be general,

If I go ahead and refresh that page and click on the WebSockets tab, you can see that I'm able to subscribe to the channel with ID of 1, which in this case happens to be general, and Rebub is telling me that that subscription is successful. And what that really means is when I come over here and send a message, this user, who shouldn't have access to the general channel, is able to receive that message. Albeit it's only in the console, but if they were snooping the network, they would be able to see that message appear. So we're going to work on correcting that today. The first thing we're going to do is head back over to our MessageSent event. And if we scroll back down to the bottom, you'll remember we tell Laravel we want to

The first thing we're going to do is head back over to our MessageSent event. And if we scroll back down to the bottom, you'll remember we tell Laravel we want to broadcast this message on a channel. Now this channel class here is a public-facing channel, which means anybody can access it without having to first authorize. The first thing we want to do is change this to a private channel. That's all we have to do here. We now tell Laravel when this event is fired, we want to broadcast it across a private channel. Back in our frontend, there's still some work to do. At the moment we are calling echo.channel, which again is going to connect us to a public

Back in our frontend, there's still some work to do. At the moment we are calling echo.channel, which again is going to connect us to a public channel. If we want to connect to a private channel, what we have to do is change this to private. You can see now that on our WebSocket connection, we have successfully established a connection to the server, but we are no longer connecting to the channel. You also may notice here in the Network tab, we have this failed request to the auth endpoint. So here we are trying to hit the broadcasting auth endpoint, and it's returning a 403 forbidden error. So there's one more thing that we need to do to tell Laravel that we should have access.

error. So there's one more thing that we need to do to tell Laravel that we should have access to this channel. When we installed broadcasting in our Laravel application, you may remember that we had this channels.php routes file published to our application. When this channel routes file is published, we are given access to a default route, which is for app.models.User.id. Now we're not going to use this for our application, but we can use it as a nice starting point. Our channel name is channels.channel. And because Laravel is awesome, we also have access to route model binding here.

Our channel name is channels.channel. And because Laravel is awesome, we also have access to route model binding here. So I can go ahead and type in channel model, and I'll have access to use it immediately here. And the nice thing about the channel model is that I have a helper on there, which tells me whether or not a User is subscribed to the given channel, which will give me a Boolean value directly. So I can go ahead here and return channel isSubscribed and pass in the given user. So here we are back in the front end, and you can see we have our connection established. We have subscribed to the channel with ID of one, and we have received a message from

So here we are back in the front end, and you can see we have our connection established. We have subscribed to the channel with ID of one, and we have received a message from Reverb to let us know that our connection has been successful. And you will also notice here that our auth endpoint has returned a successful response. If we take a quick look in the response, you will see in the response that we have received an authorization token. Let's talk a little bit about what that's actually doing under the hood. When we make a request to the broadcasting auth endpoint within Laravel, we hit that channels.php routes file. Laravel passes it the user, the currently authenticated user, and the channel.

channels.phprouts file. Laravel passes it the User, the currently authenticated User, and the channel. Assuming that Boolean value passes true, Laravel will go ahead and create an authorization token for us. Echo will then take that authorization token and use it when making a WebSocket request to join that channel. That token will eventually make its way into Reverb. Reverb will use that to make sure that the signature on the request is correct for the payload that's been sent. Assuming all those things work out correctly, we are granted access to the channel and we're

payload that's been sent. Assuming all those things work out correctly, we are granted access to the channel and we're able to send messages freely. Just to wrap this up, I'm now logged back in with this User on the left-hand side who should access general and this user on the right-hand side who shouldn't access general. You can see now on the left-hand side that we are connected and we can still go ahead and send messages here. But on the right-hand side, we are only receiving confirmation that we are connected to the WebSocket server. We're no longer able to connect to the general channel.

WebSocket server. We're no longer able to connect to the general channel. And you can see that the authorization endpoint has failed, which prevents us from connecting. With those very simple changes to our application, we're able to lock down those channels and ensure that only the users that should have access do have access.