Stephen Rees-Carter

Security Tips

Security Tip: Bypassing Content-Security-Policy with <base>!

[Tip #122] Content Security Policies are awesome, but if you haven't fully configured all of your directives, it's possible to redirect requests, inherit Nonces, and get juicy CSP-bypassing XSS! 😈

Security Tips

Security Tip: When Is XSS Not Strictly XSS? (But Still Bad!)

[Tip #121] Technically, XSS involves injecting malicious Javascript, but sometimes you don't need any JS to get up to mischief! 😈

Birthday Retrospective

4 years of Securing Laravel! 🎂

I almost missed it, but it's time to celebrate 4 years of Securing Laravel!

Security Tips

Security Tip: Password Resets and MFA?

[Tip #120] How should we safely handle resetting forgotten passwords without compromising the protection that MFA provides?

Security Tips

Security Tip: Account Recovery for MFA?

[Tip #119] What happens if your users lose their MFA tokens, and they never saved their recovery codes? Can you safely give them back access to their accounts?

Security Tips

Security Tip: 2FA Isn't Just For Logins!

[Tip #118] Account passwords are easy to compromise, so why are you relying on them to verify users within your app? If your users log in with a 2FA Token, then they should be able to prove it before performing other sensitive activities too.

In Depth

In Depth: Setting up Two-Factor Authentication!

[In Depth #37] It's time to finally fulfil one of the most common requests for an In Depth article: setting up 2FA! 🎉 So let's add some TOTP 2FA to our boring user/pass auth login!

Security Tips

Security Tip: Do I Have a Vulnerable Package Installed?

[Tip #117] It's easy to say "Update <package> if it's installed!", but how do you actually know if a package is installed, since it may not appear in composer.json?! Also, how did it even get there??!! 🤨

Security Notice

Laravel Security Notice: Livewire v3 Remote Code Execution Vulnerability!

[Notice #4] Livewire v3 is vulnerable to an RCE (Remote Command Execution) during component property update hydration in specific scenarios. ⚠️ Update your Livewire ASAP! ⚠️

Security Tips

Security Tip: Add Authorisation at the Start!

[Tip #116] Is it a "premature optimisation" to add authorisation to your app before you know how your authorisation will be structured?

Security Tips

Security Tip: Scoping orWhere Can Be Disastrous!

[Tip #115] Let's take a look at why something as simple and "harmless" as an orWhere can introduce a huge privacy risk to your application, and how you can avoid it!

In Depth

In Depth: A Deep Dive into Laravel's New Starter Kits! (pt 2)

[In Depth #36] It's time to review the Livewire Volt, Vue, and React Starter Kits! Let's see what vulnerabilities are hiding under the surface, and just how easy it is to fix them... 🧐