Security Tip: OTPs Need Rate Limiting Too!

[Tip #110] This is your periodic reminder that Rate Limiting is essential, and for more than just your user/password form! Make sure you've got it on your OTP, or someone will come along and brute-force that 6-digit code.

Security Tip: Yes, Your .Env Is Secure Enough!

[Tip #109] I get asked this all the time, so it's time to set the record straight: there is nothing insecure about storing your credentials in a .env, as long as you keep your .env protected!

In Depth: What Actually Is MFA?

[In Depth #34] MFA, 2FA, 2SV, DFA... Something you know/have/are... Let's figure out this MFA thing and why it's so important.

Security Tip: Temporary Local File URLs!

[Tip #108] Temporary URLs for file access is an essential piece of the security puzzle, which up until recently were only available out-of-the-box for the S3 driver. Now you can easily generate them for local files too!

Security Tip: Excluding SVGs from Image Validation!

[Tip #107] Laravel 12 introduced a seemingly minor change - image validation now excludes SVGs by default. 🤔 Let's take a look at why this is so important! 🤓

Security Tip: Limiting bcrypt Passwords to 72 Bytes!

[Tip #106] Laravel 12 gives us the ability to reject passwords longer than 72 bytes for bcrypt, but you need to turn it on manually. Oh, and don't forget to add a validation rule, or you'll be throwing suspicious 500 server errors! 😱

Security Tip: Run Your CSP in Local Development!

[Tip #105] These are my top 3 tips for getting started with a Content Security Policy - as proven by a friend who went from failing security scans to passing with flying colours.

Security Tip: Type Coercion in Broadcast Routes!

[Tip #104] It's easy for type juggling to sneak into authorisation callbacks, especially when types are ambiguous, and if you're not careful, you may be leaving a massive hole waiting to be exploited! 😱

In Depth: Common Authorisation Failures!

[In Depth #33] Let's explore a number of common ways developers fail authorisation in Laravel apps, and what you need to watch out for so you don't make the same mistakes!

Security Tip: Don't Roll Your Own Crypto!

[Tip #103] It's story time! Let's look at the SHA-3 competition as a reminder that crypto is hard... 😱

Security Tip: Do You Have an Upgrade Plan?

[Tip #102] In less than 2 weeks, Laravel 10.x will no longer be supported, and PHP 8.1 has less than 12 months left! Do you have an upgrade plan?

Security Tip: Should You Limit Password Lengths?

[Tip #101] Password length limits are often a sign of a legacy backend or insecure hashing, but did you know bcrypt only hashes the first 72 characters? It raises the question, should we be limiting password lengths when using bcrypt too? 🤔