Newsletter

In Depth: Securing Randomness Without Breaking Things

[InDepth#14] Cryptographically secure randomness is important, but so is backwards compatibility...

Securing Laravel

Mar 22, 2023 — 7 min read

Back in Tip #19, I wrote about Cryptographically Secure Randomness2, and advised that Laravel’s `Arr::random()` and `Arr::shuffle()` methods are not cryptographically secure, and therefore should be considered unsafe to use for any secure applications or purposes that require true randomness. (I’ll explain why they aren’t secure shortly.)

While these methods are fine for things like displaying a list of items in a random order every time a page loads, they are also commonly used for things like picking competition winners and generating passwords and tokens. In both of these cases, predictability is a problem that can introduce bias or allow an attacker to guess values and bypass security controls.

A great example, which I am unable to find a link for3, is referenced on Security StackExchange: “In practice, cases where it will actually make a real difference are extremely rare, but there have been cases where it has been abused. The best (and only) example I know of is at a casino slot machine in Montreal where this guy spent weeks trying to find patterns and eventually did because of the seed.”. The Lumiere Place Casino in St. Louis noted similar attacks on their slot machines. While these examples aren’t specific Laravel or even PHP based, both occurred due to the use of insecure randomness.

Insecure Implementations

So the first question is: Why are Laravel’s methods insecure?

Security Tip: Privilege Escalation Through Domain Wildcards!

[Tip #80] It's incredibly common to find hardcoded domains used for identifying admins, however this also makes it trivial to escalate privileges to admin!

Security Tip: Only Use env() Within Config Files

[Tip #79] It may be tempting to reach for env() outside your config files, but you may be introducing subtle bugs, or exposing your app to compromise...

Security Tip #78: Laravel 11's Per-Second Rate Limiting

Up until now, Laravel has only supported rate limiting per-minute, but that didn't work in some scenarios, as a minute is a very long time. To solve this, Laravel 11 supports per-second!

Security Tip #77: Laravel 11's Prompt Validation Rules

We often talk about validating user input from the browser, but what about user input on the command line? Validation is just as useful there too!