Laravel Security: A Guide to Best Practices

Security is a crucial aspect of modern web development. Laravel includes many security features out of the box, but it’s important to understand how to use them effectively.

1. CSRF Protection

Laravel automatically protects your forms against CSRF (Cross-Site Request Forgery) attacks.

<form method="POST" action="/profile">
    @csrf
    <!-- Form fields -->
</form>

Custom configuration

// config/session.php
return [
    'token_lifetime' => 120, // minutes
];

2. XSS Protection

Automatic escaping with Blade

{{ $userInput }} // Automatically escaped
{!! $trustedHtml !!} // Not escaped - use with caution

Security middleware

// app/Http/Middleware/SecurityHeaders.php
public function handle($request, Closure $next)
{
    $response = $next($request);
    
    $response->headers->set('X-XSS-Protection', '1; mode=block');
    $response->headers->set('X-Frame-Options', 'SAMEORIGIN');
    $response->headers->set('X-Content-Type-Options', 'nosniff');
    
    return $response;
}

3. Authentication and Authorization

Configuring Sanctum for APIs

composer require laravel/sanctum

php artisan vendor:publish --provider="Laravel\Sanctum\SanctumServiceProvider"

Route protection example

Route::middleware(['auth:sanctum'])->group(function () {
    Route::get('/user/profile', function () {
        return auth()->user();
    });
});

Policies for authorization

php artisan make:policy PostPolicy --model=Post

class PostPolicy
{
    public function update(User $user, Post $post)
    {
        return $user->id === $post->user_id;
    }
}

4. Data Validation

Validation in requests

class StoreUserRequest extends FormRequest
{
    public function rules()
    {
        return [
            'email' => 'required|email|unique:users',
            'password' => 'required|min:8|regex:/^.*(?=.{3,})(?=.*[a-zA-Z])(?=.*[0-9]).*$/',
            'name' => 'required|string|max:255'
        ];
    }
}

5. Secure Session Management

Session configuration

// config/session.php
return [
    'driver' => env('SESSION_DRIVER', 'file'),
    'lifetime' => env('SESSION_LIFETIME', 120),
    'expire_on_close' => false,
    'encrypt' => true,
    'secure' => true, // For HTTPS
];

6. Protection Against SQL Injection

Using prepared statements

// Bad practice
$users = DB::select('select * from users where active = ' . $active);

// Good practice
$users = DB::select('select * from users where active = ?', [$active]);

7. Secure Password Storage

// In the User model
public function setPasswordAttribute($value)
{
    $this->attributes['password'] = Hash::make($value);
}

8. Logging and Monitoring

// config/logging.php
'channels' => [
    'security' => [
        'driver' => 'daily',
        'path' => storage_path('logs/security.log'),
        'level' => 'warning',
        'days' => 14,
    ],
],

Additional Best Practices

1. Use HTTPS in production
2. Regularly update Laravel and its dependencies
3. Configure file permissions correctly
4. Use environment variables for sensitive information
5. Implement rate limiting

Conclusion

Security is an ongoing process that requires constant vigilance. Laravel provides many tools to secure your application, but it’s crucial to understand them and use them correctly.

Useful Resources

• Official Laravel Security Documentation
• OWASP Top 10
• Laravel Security Checklist