So I'm trying a few token based authentication in Laravel, each user have token they can use to access certain database. But there is something I still don't understand from these tutorial. The tutorials seem to only check whether a user have token, if yes then authenticate the profile to do certain api call, but obviously this is not secure.
When let's say a user "Andrew" has his own token and say he can see his own profile (in a 'profile' table), he can also see other people's profile providing he have his own token, if he can guess the api call for that other profile. Let's say he simply seen the api call for his profile
example.site/getprofile?id=22 and try changing the id to see other's profile, and he will be authenticated because he has token.
How do I make sure that he can't see other's profile? what is the best practice?