Laravel 5.6 broadcasting on a private channel

A public channel broadcasts to anyone who subscribes, which is fine for a status page and wrong for anything showing a user their own data.

class OrderShipped implements ShouldBroadcast
{
    public function broadcastOn()
    {
        return new PrivateChannel('orders.' . $this->order->customer_id);
    }
}

// routes/channels.php — the authorisation, which is the whole mechanism
Broadcast::channel('orders.{customerId}', function ($user, $customerId) {
    return (int) $user->id === (int) $customerId;
});

The channel authorisation callback is a normal HTTP request to your application before the socket subscribes, so it has the session and can use the same policies as everything else. The strict comparison in that callback is not decoration — a loose comparison between a string route segment and an integer id has produced real authorisation bugs. Anything broadcast is serialised and leaves the server, so a model with a hidden attribute still needs checking.