Don't miss the Laracon Online Discount!
Subscribe now to get 25% off your Laravel Security In Depth subscription!
Read more
5 years of Securing Laravel!
Yikes! I've been writing Securing Laravel for 5 years! 😲
Security Tip: Help Password Managers Get It Right!
[Tip #134] Laravel's password helper has a great little feature you may have missed: it can generate browser-friendly password rules automatically! 🤓
In Depth: From Serialised String to RCE!
[In Depth #42] unserialize() looks harmless - it just rebuilds your data - but feed it the wrong string and it'll rebuild an attacker's object, quietly turning Laravel's own code into remote code execution. Let's pull a real RCE apart. 😈
Security Tip: Do You Know Your SameSite Cookies?
[Tip #133] SameSite=Lax is the Laravel default, and it quietly protects you from CSRF. So why do I keep finding SameSite=None in the apps I audit? Let's talk about what it does and how to use it safely.