Safely saving a new post, laravel?

Question

Laravel

The site works as usual: only the admin is allowed into the admin panel, in the admin panel it fills in the title of the new post and its content, then axios sends a POST request to the address "site.ru/news" (in the headers, as expected, there is X-CSRF-TOKEN ).
So, I'm concerned about safety. After all, an advanced user without going to the admin panel can send a POST request to my address "site.ru/news" with their data and, in fact, the server will process it as it should and save it to the database. What actions are smart people taking to prevent this from happening?

Answer 1

They close editing endpoints with the same middleware with authorization check as the admin panel. They use gates and policies . Read documentation .

Answer 2

The server will not process, because an advanced user will not have an admin token CSRF in session.