// if post isn't found by $id, show 404 $post = Post::findOrFail($id); // if user isn't owner of post, show 403 if (!Auth::user() || Auth::user()->id != $post->user_id) { abort(403); } return view('post-edit',compact('post'));