Securing Laravel

Home
Practical Laravel Security
Laravel Security Audits
In Depths
Tips
Audits Top 10
OWASP Top 10
Archive
About
New
Top
Discussion
Security Tip: Security Headers are Layers of Defence
[Tip#46] Security headers add important layers of defence to your apps, preventing data leaks, XSS and CSRF attacks, clickjacking, and more... Why are…
 • 
Stephen Rees-Carter
Laravel Security In Depth → Securing Laravel
Let's talk about all the changes: new name, new domain, and a purple logo...
 • 
Stephen Rees-Carter
In Depth: What Are Insecure Functions?
[InDepth#16] According to random folks on the internet (i.e. social media), "insecure functions" are a wide and varied concept. Let's take a look at the…
 • 
Stephen Rees-Carter
Security Tip: Replace Simple Dependencies
[Tip#45] The more dependencies your project has, the higher your risk of supply-chain attack is, and the less you're aware of what code is actually…
1
Security Tip: Avoiding XSS with HtmlString
[Tip#44] Checkout that one simple trick... I mean... This is my favourite way to avoid XSS.
 • 
Stephen Rees-Carter
April 2023
Security Tip: Don't Forget Rate Limiting
[Tip#43] It's essential for limiting bot attacks, and don't forget it on other sensitive routes like authentication...
 • 
Stephen Rees-Carter
In Depth: Mass-Assignment Vulnerabilities
[InDepth#15] There is a false confidence about mass-assignment vulnerabilities that hides how easy it is for them to occur and be exploited...
 • 
Stephen Rees-Carter
Security Tip: Validating Array Inputs
[Tip#42] Validating single values is easy, but what about arrays?
March 2023
Security Tip: Safely Rendering JSON in Blade
[Tip#41] It's quite common to inject JSON into Blade templates - but is it safe?
 • 
Stephen Rees-Carter
6
In Depth: Securing Randomness Without Breaking Things
[InDepth#14] Cryptographically secure randomness is important, but so is backwards compatibility...
Security Tip: Retrieving Request Values
[Tip#40] Let's complete the set of request input helpers and their security implications
Security Tip: Casing Request Values
[Tip#39] Not a new feature, but definitely worth knowing about.
 • 
Stephen Rees-Carter
© 2023 Stephen Rees-Carter
Privacy ∙ Terms ∙ Collection notice
Start WritingGet the app
Substack is the home for great writing