# Restricting data in controller's index method by user id

**URL:** <https://discourse.cakephp.org/t/restricting-data-in-controllers-index-method-by-user-id/1533>\
**Category:** Need Help\
**Created:** [November 14, 2016, 11:33am UTC](https://discourse.cakephp.org/t/restricting-data-in-controllers-index-method-by-user-id/1533 "2016-11-14T11:33:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ari](https://avatars.discourse-cdn.com/v4/letter/a/5f8ce5/32.png) [@ari](https://discourse.cakephp.org/u/ari)\
**Post date:** [November 14, 2016, 11:33am UTC](https://discourse.cakephp.org/t/restricting-data-in-controllers-index-method-by-user-id/1533/1 "2016-11-14T11:33:01Z")

</div>

Hi. From the great tutorial I could pick up the right way to restrict user access to certain data in the Controller’s isAuthorized method. However, I wonder what is the right way of restricting the data in Controller’s index() method?

That is, if I have a User mapped to Customer, where and how I should restrict the data shown in the (index) view to contain only those Customers which belong to the User? Of course, I could walkthrough the CustomersTable object in the CustomersController index method and strip the “extra” customers, but somehow I feel that this should be done in the CustomersTable, but how? Probably there is an easy way which I just can’t think of.

Any help would be highly appreaciated.

---

<div class="post-metadata">

**Author:** ![zmurphy](https://avatars.discourse-cdn.com/v4/letter/z/cc9497/32.png) [@zmurphy](https://discourse.cakephp.org/u/zmurphy)\
**Post date:** [November 14, 2016, 5:47pm UTC](https://discourse.cakephp.org/t/restricting-data-in-controllers-index-method-by-user-id/1533/2 "2016-11-14T17:47:52Z")

</div>

@ari

In your action can you not do something like:

$userId = $this-\>Auth-\>user(‘id’);  
$customers = $this-\>Users-\>find()-\>where([‘id’ =\> $id])-\>first()-\>customers;

$this-\>set(‘customers’, $customers);

---

<div class="post-metadata">

**Author:** ![ari](https://avatars.discourse-cdn.com/v4/letter/a/5f8ce5/32.png) [@ari](https://discourse.cakephp.org/u/ari)\
**Post date:** [November 14, 2016, 6:41pm UTC](https://discourse.cakephp.org/t/restricting-data-in-controllers-index-method-by-user-id/1533/3 "2016-11-14T18:41:08Z")

</div>

Thanks for reply. I read the docs a bit more and ended myself using the following in index():  
`$customers = $this->Customers->find('all')->where(['Customers.user_id' => $userId]);`