# Securing Laravel
> The essential security resource for Laravel developers.
Public Ghost content for AI and LLM tooling. Use `/llms-full.txt` for consolidated page and post context.
Append `.md` to any post or page URL to get the content in Markdown (for example, `/example-post.md`).

## Pages
- [4,000 Subscribers Celebration! 🎉](https://securinglaravel.com/4000.md) - Nice work, you found it! 😁 Since Securing Laravel has just hit 4,000 subscribers, it feels right to give a matching discount on premium subscriptions! I considered 40% off, but percentages are boring and overused. So instead, how about $40 off yearly, or $4 off monthly? Now that you're here, it's…
- [Welcome to Securing Laravel!](https://securinglaravel.com/about.md) - Hey there, I'm Stephen Rees-Carter, the creator of Securing Laravel. It's awesome to meet you and I want to welcome you to our community! I started Securing Laravel (then called Laravel Security In Depth) back in August 2021 as a way to share my security knowledge with the Laravel community, alongs…
- [Sponsor Securing Laravel](https://securinglaravel.com/sponsor.md) - Want to get your brand in front of thousands of Laravel developers every week, while supporting security education across the Laravel ecosystem? Sponsoring Securing Laravel is the perfect way to do both. Every week* I publish a new Laravel Security Tip, covering a wide range of security topics to h…
- [Start a 7 Day Trial](https://securinglaravel.com/start-a-7-day-trial.md) - Hey there! Due to limitations with this platform, I can't send you to a shiny sales page that offers 7-day trials and lets you pick which billing cycle you'd prefer when the trial ends. So you're stuck with two boring buttons... Start a 7-day trial on monthly billingStart a 7-day trial on yearly bi…
- [Stephen Is Uncontactable Sale?! 😱](https://securinglaravel.com/stephen-is-uncontactable-sale.md) - I haven't done a sale on Securing Laravel in a while, and I will be disconnected from the internet until Saturday, so now is the perfect time for a sale, right?? I really don't like doing things normally, so this just feels right! 😎

## Posts
- [Security Tip: Do You Know Your SameSite Cookies?](https://securinglaravel.com/security-tip-do-you-know-your-samesite-cookies.md) - [Tip #133] SameSite=Lax is the Laravel default, and it quietly protects you from CSRF. So why do I keep finding SameSite=None in the apps I audit? Let's talk about what it does and how to use it safely.
- [In Depth: Three Reasonable Decisions, One Critical Vulnerability](https://securinglaravel.com/in-depth-three-reasonable-decisions-one-critical-vulnerability.md) - [In Depth #41] What do you get when you combine an API, SameSite=None, and a Session cookie?
- [Security Tip: Have You Heard Of Slopsquatting?](https://securinglaravel.com/security-tip-have-you-heard-of-slopsquatting.md) - [Tip #132] Your AI agent hallucinates a package name, confidently installs it, and keeps working - except an attacker registered that exact name, packed with malware. Welcome to slopsquatting.
- [Security Tip: Safely Updating Dependencies](https://securinglaravel.com/security-tip-safely-updating-dependencies.md) - [Tip #131] Updating packages used to be a no-brainer, but now you need to be careful. Updates may be malicious. But not updating leaves vulns unpatched. So what do you do??? 🤷
- [In Depth: Version Numbers Are Vanity Labels](https://securinglaravel.com/in-depth-version-numbers-are-vanity-labels.md) - [In Depth #40] We trust version numbers to mean a specific, fixed release - but they're really just labels pointing at a commit, and an attacker can quietly move them. Let's dig into tag hijacking, the attack behind tj-actions and Laravel-Lang. 😈
- [Security Tip: Secure Your Repositories with Laravel Moat](https://securinglaravel.com/security-tip-secure-your-repositories-with-laravel-moat.md) - [Tip #130] Laravel Moat is a new tool that assesses the security posture of your GitHub repositories and recommends ways to tighten the controls protecting them.
- [Security Tip: The Signed URL Trap](https://securinglaravel.com/security-tip-the-signed-url-trap.md) - [Tip #129] I love Signed URLs, but there is one very subtle trap you can accidentally fall into...
- [In Depth: Don't Trust Public Livewire Properties](https://securinglaravel.com/in-depth-dont-trust-public-livewire-properties.md) - [In Depth #39] Public Properties may look like PHP class properties, but they're really hidden form fields, just waiting for your input... 😈
- [Security Tip: Stop Putting Actions on GET Requests!](https://securinglaravel.com/security-tip-stop-putting-actions-on-get-requests.md) - [Tip #128] Do you know the difference between GET and POST requests, and why it's so important that GET requests only ever retrieve data?
- [Security Tip: Your JWT Might Be a Forever Key!](https://securinglaravel.com/security-tip-your-jwt-might-be-a-forever-key.md) - [Tip #127] Without an `exp` claim, a JWT can remain valid forever, turning a leaked token into permanent access.
- [Security Tip: Validate Config at Boot](https://securinglaravel.com/security-tip-validate-config-at-boot.md) - [Tip #126] Rather than checking for essential config when it's used, throw the checks in your Service Provider - you'll know about configuration failures before your users get a weird error.
- [In Depth: Email Verification Isn't as Simple as You Think](https://securinglaravel.com/in-depth-email-verification-isnt-as-simple-as-you-think.md) - [In Depth #38] You can't trust an email address you haven't verified, so why are you storing them in your database?
- [Security Tip: Consider All Routes, Not Just Web!](https://securinglaravel.com/security-tip-consider-all-routes-not-just-web.md) - [Tip #125] routes/web.php is boring and reliable, and routes/api.php is fancy, but have you forgotten one?
- [Security Tip: Update your packages! (Yes, this again!)](https://securinglaravel.com/security-tip-update-your-packages-yes-this-again.md) - [Tip #124] I know I say this all the time (especially on stage!), but apparently not everyone heard me, so here we go again...
- [Security Tip: How Should APIs Respond to HTTP?](https://securinglaravel.com/security-tip-how-should-apis-respond-to-http.md) - [Tip #123] If an API client tries to connect via unencrypted HTTP, what should your API do: redirect to HTTPS, disable HTTP, offer a swift rebuke, or take matters into it's own hands?
- [Security Tip: Bypassing Content-Security-Policy with <base>!](https://securinglaravel.com/security-tip-bypassing-content-security-policy-with-base.md) - [Tip #122] Content Security Policies are awesome, but if you haven't fully configured all of your directives, it's possible to redirect requests, inherit Nonces, and get juicy CSP-bypassing XSS! 😈
- [Security Tip: When Is XSS Not Strictly XSS? (But Still Bad!)](https://securinglaravel.com/security-tip-when-is-xss-not-strictly-xss-but-still-bad.md) - [Tip #121] Technically, XSS involves injecting malicious Javascript, but sometimes you don't need any JS to get up to mischief! 😈
- [4 years of Securing Laravel! 🎂](https://securinglaravel.com/4-years.md) - I almost missed it, but it's time to celebrate 4 years of Securing Laravel!
- [Security Tip: Password Resets and MFA?](https://securinglaravel.com/security-tip-password-resets-and-mfa.md) - [Tip #120] How should we safely handle resetting forgotten passwords without compromising the protection that MFA provides?
- [Security Tip: Account Recovery for MFA?](https://securinglaravel.com/security-tip-account-recovery-for-mfa.md) - [Tip #119] What happens if your users lose their MFA tokens, and they never saved their recovery codes? Can you safely give them back access to their accounts?
- [Security Tip: 2FA Isn't Just For Logins!](https://securinglaravel.com/security-tip-2fa-isnt-just-for-logins.md) - [Tip #118] Account passwords are easy to compromise, so why are you relying on them to verify users within your app? If your users log in with a 2FA Token, then they should be able to prove it before performing other sensitive activities too.
- [In Depth: Setting up Two-Factor Authentication!](https://securinglaravel.com/in-depth-setting-up-two-factor-authentication.md) - [In Depth #37] It's time to finally fulfil one of the most common requests for an In Depth article: setting up 2FA! 🎉 So let's add some TOTP 2FA to our boring user/pass auth login!
- [Security Tip: Do I Have a Vulnerable Package Installed?](https://securinglaravel.com/security-tip-do-i-have-a-vulnerable-package-installed.md) - [Tip #117] It's easy to say "Update <package> if it's installed!", but how do you actually know if a package is installed, since it may not appear in composer.json?! Also, how did it even get there??!! 🤨
- [Laravel Security Notice: Livewire v3 Remote Code Execution Vulnerability!](https://securinglaravel.com/security-notice-livewire-v3-rce.md) - [Notice #4] Livewire v3 is vulnerable to an RCE (Remote Command Execution) during component property update hydration in specific scenarios. ⚠️ Update your Livewire ASAP! ⚠️
- [Security Tip: Add Authorisation at the Start!](https://securinglaravel.com/security-tip-add-authorisation-at-the-start.md) - [Tip #116] Is it a "premature optimisation" to add authorisation to your app before you know how your authorisation will be structured?
- [Security Tip: Scoping orWhere Can Be Disastrous!](https://securinglaravel.com/security-tip-scoping-orwhere-can-be-disastrous.md) - [Tip #115] Let's take a look at why something as simple and "harmless" as an orWhere can introduce a huge privacy risk to your application, and how you can avoid it!
- [In Depth: A Deep Dive into Laravel's New Starter Kits! (pt 2)](https://securinglaravel.com/in-depth-a-deep-dive-into-laravels-new-starter-kits-pt-2.md) - [In Depth #36] It's time to review the Livewire Volt, Vue, and React Starter Kits! Let's see what vulnerabilities are hiding under the surface, and just how easy it is to fix them... 🧐
- [Security Tip: Eloquent Casting to HtmlString!](https://securinglaravel.com/security-tip-eloquent-casting-to-htmlstring.md) - [Tip #114] One of my favourite Laravel features, the humble HtmlString, is now available as an Eloquent Cast - which should make it much more accessible! 🎉 But there is a catch... 😟
- [Security Tip: Don't Generate Your Own Passwords!](https://securinglaravel.com/security-tip-dont-generate-your-own-passwords.md) - [Tip #113] "Don't Roll Your Own Crypto" applies to password generators too! It's way too easy to unknowingly lower your entropy by trying to be clever... 😱
- [Security Tip: Don't Use phpinfo()!](https://securinglaravel.com/security-tip-dont-use-phpinfo.md) - [Tip #112] It may seem like a harmless debugging tool, with a bunch of boring config values and version numbers, but phpinfo() is a goldmine of sensitive data - even when it's "protected" in an admin account! 😈
- [In Depth: A Deep Dive into Laravel's New Starter Kits! (pt 1)](https://securinglaravel.com/in-depth-a-deep-dive-into-laravels-new-starter-kits-pt-1.md) - [In Depth #35] Let's take a dive into the security of Laravel's new Starter Kits to see how they handle authentication, what security features they include, and what areas could be improved! 🤓
- [Security Tip: What Can We Learn from CommonMark's XSS?](https://securinglaravel.com/security-tip-what-can-we-learn-from-commonmarks-xss.md) - [Tip #111] The recently patched XSS in CommonMark's Attributes extension offers an interesting look at what happens when two different features conflict, one being a security feature, the other a knowingly vulnerable extension.
- [Security Tip: OTPs Need Rate Limiting Too!](https://securinglaravel.com/security-tip-otps-need-rate-limiting-too.md) - [Tip #110] This is your periodic reminder that Rate Limiting is essential, and for more than just your user/password form! Make sure you've got it on your OTP, or someone will come along and brute-force that 6-digit code.
- [Security Tip: Yes, Your .Env Is Secure Enough!](https://securinglaravel.com/security-tip-yes-your-env-is-secure-enough.md) - [Tip #109] I get asked this all the time, so it's time to set the record straight: there is nothing insecure about storing your credentials in a .env, as long as you keep your .env protected!
- [In Depth: What Actually Is MFA?](https://securinglaravel.com/in-depth-what-actually-is-mfa.md) - [In Depth #34] MFA, 2FA, 2SV, DFA... Something you know/have/are... Let's figure out this MFA thing and why it's so important.
- [Security Tip: Temporary Local File URLs!](https://securinglaravel.com/security-tip-temporary-local-file-urls.md) - [Tip #108] Temporary URLs for file access is an essential piece of the security puzzle, which up until recently were only available out-of-the-box for the S3 driver. Now you can easily generate them for local files too!
- [Security Tip: Excluding SVGs from Image Validation!](https://securinglaravel.com/security-tip-excluding-svgs-from-image-validation.md) - [Tip #107] Laravel 12 introduced a seemingly minor change - image validation now excludes SVGs by default. 🤔 Let's take a look at why this is so important! 🤓
- [Security Tip: Limiting bcrypt Passwords to 72 Bytes!](https://securinglaravel.com/security-tip-limiting-bcrypt-passwords-to-72-bytes.md) - [Tip #106] Laravel 12 gives us the ability to reject passwords longer than 72 bytes for bcrypt, but you need to turn it on manually. Oh, and don't forget to add a validation rule, or you'll be throwing suspicious 500 server errors! 😱
- [Security Tip: Run Your CSP in Local Development!](https://securinglaravel.com/security-tip-run-your-csp-in-local-development.md) - [Tip #105] These are my top 3 tips for getting started with a Content Security Policy - as proven by a friend who went from failing security scans to passing with flying colours.
- [Security Tip: Type Coercion in Broadcast Routes!](https://securinglaravel.com/security-tip-type-coercion-in-broadcast-routes.md) - [Tip #104] It's easy for type juggling to sneak into authorisation callbacks, especially when types are ambiguous, and if you're not careful, you may be leaving a massive hole waiting to be exploited! 😱
- [In Depth: Common Authorisation Failures!](https://securinglaravel.com/in-depth-common-authorisation-failures.md) - [In Depth #33] Let's explore a number of common ways developers fail authorisation in Laravel apps, and what you need to watch out for so you don't make the same mistakes!
- [Security Tip: Don't Roll Your Own Crypto!](https://securinglaravel.com/security-tip-dont-roll-your-own-crypto.md) - [Tip #103] It's story time! Let's look at the SHA-3 competition as a reminder that crypto is hard... 😱
- [Security Tip: Do You Have an Upgrade Plan?](https://securinglaravel.com/security-tip-do-you-have-an-upgrade-plan.md) - [Tip #102] In less than 2 weeks, Laravel 10.x will no longer be supported, and PHP 8.1 has less than 12 months left! Do you have an upgrade plan?
- [Security Tip: Should You Limit Password Lengths?](https://securinglaravel.com/security-tip-should-you-limit-password-lengths.md) - [Tip #101] Password length limits are often a sign of a legacy backend or insecure hashing, but did you know bcrypt only hashes the first 72 characters? It raises the question, should we be limiting password lengths when using bcrypt too? 🤔
- [In Depth: Five Ways to Fail at Authentication](https://securinglaravel.com/in-depth-five-ways-to-fail-at-authentication.md) - [In Depth #32] Let's explore 5 different "Authentication Fails" that I've come across, as a reminder for why it's so important to get authentication right.
- [Security Tip: What If You Hashed Null?](https://securinglaravel.com/security-tip-what-if-you-hashed-null.md) - [Tip #100] One of the fun parts of doing my security audits is coming across unexpected code that looks exploitable, and trying it out myself to see what possibilities exist.
- [Security Tip: Please Stop Hardcoding Admin Domains!](https://securinglaravel.com/security-tip-please-stop-hardcoding-admin-domains.md) - [Tip #99] Let me tell you a story about a time when a single missing character allowed me to escalate my privileges and gain admin access, despite all the protections designed to stop me! 😈
- [Security Tip: strip_tags() Won't Save You from XSS!](https://securinglaravel.com/security-tip-strip_tags-wont-save-you-from-xss.md) - [Tip #98] XSS doesn't just hide in <script> tags - it sneaks in through HTML attributes, links, and even inline styles! Don't rely on functions like strip_tags() to keep you safe...
- [Security Tip: Be Intentional with Your Outputs!](https://securinglaravel.com/security-tip-be-intentional-with-your-outputs.md) - [Tip #97] XSS loves to sneak into your apps when you're not paying attention, so you need to be intentional with your outputs and think about every piece of user input you're using in your apps!
- [Laravel Security Notice: Laravel Environment Manipulation via Query String](https://securinglaravel.com/laravel-security-notice-laravel-environment-manipulation-via-query-string.md) - [Notice #3] Update your Laravel version and ensure `register_argc_argv` is disabled non-CLI commands!
- [In Depth: Laravel Security Audits Top 10 (2024)!](https://securinglaravel.com/in-depth-laravel-security-audits-top-10-2024.md) - [In Depth #31] Here are the Top 10 security issues I've found during my security audits, highlighting the areas we as a community need to improve our security.
- [Security Tip: Ensure Your App Requires HTTPS!](https://securinglaravel.com/security-tip-ensure-your-app-requires-https.md) - [Tip #96] Encryption is essential, but you can't just install a certificate and go about your day... Secure those cookies, redirect from HTTP, and HSTS FTW! 🎉
- [Security Tip: Can You Safely Unserialise Classes?](https://securinglaravel.com/security-tip-can-you-safely-unserialise-classes.md) - [Tip #95] While you really shouldn't unserialise anything you get from a user, occasionally you have no choice... so how do you do it safely?
- [Security Tip: Disallowing Functions with PHPStan!](https://securinglaravel.com/security-tip-disallowing-functions-with-phpstan.md) - [Tip #94] Just like we can detect insecure functions with Pest, we can use PHPStan extensions to find and disallow insecure functions!
- [In Depth: Pentesting Laravel part 4 - Reading Code Pays Off!](https://securinglaravel.com/in-depth-pentesting-laravel-part-4-reading-code-pays-off.md) - [In Depth #30] In the final part of the series, we finish our code searches and spend some time reading the code - which really pays off in terms of finding juicy vulnerabilities to exploit and report.
- [Security Tip: Pest's Security Preset & Strict Equality](https://securinglaravel.com/security-tip-pests-security-preset-strict-equality.md) - [Tip #93] Test suites aren't just for raw code expectations, it turns out you can also use them to encourage secure coding practices!
- [Security Tip: Auto-Secure Cookies FTW! 🎉](https://securinglaravel.com/security-tip-auto-secure-cookies-ftw.md) - [Tip #92] One of my personal pet peeves in Laravel has finally been fixed! The Secure cookie attribute will now match the request protocol! 🎉 (I'm excited, can you tell?)
- [Security Tip: Parameterise your Parameter Names!](https://securinglaravel.com/security-tip-parameterise-your-parameter-names.md) - [Tip #91] aka yet another example for why you should Never Trust User Input!
- [In Depth: Pentesting Laravel part 3 - Looking for "Interesting" Code](https://securinglaravel.com/in-depth-pentesting-laravel-part-3-looking-for-interesting-code.md) - [In Depth #29] It's time to spend some time looking for smelly or suspicious code, searching for common patterns and functions that usually show up around weaknesses. 🕵️
- [3 years of Securing Laravel! 🎂](https://securinglaravel.com/3-years.md) - Thank you for 3 incredible years of security in the Laravel community!
- [Security Tip: Validating (Secure) URLs!](https://securinglaravel.com/security-tip-validating-secure-urls.md) - [Tip #90] Did you know Laravel's URL validator lets you control which protocols you accept? Here's my recommendation...
- [Security Tip: Intercepting dump() Could Expose Production!](https://securinglaravel.com/security-tip-intercepting-dump-could-expose-production.md) - [Tip #89] dump() interceptors in dev tools like Herd and Telescope are very helpful, but be careful you don't accidently send dump() to production!
- [Security Tip: Don't Forget to Test Your Signed URLs!](https://securinglaravel.com/security-tip-dont-forget-to-test-your-signed-urls.md) - [Tip #88] Signed URLs are awesome, but if you forget to check they are working - you may be leaving a massive vulnerability just waiting to be exploited...
- [Security Tip: Stop Using MD5 and SHA-1!](https://securinglaravel.com/security-tip-stop-using-md5-and-sha-1.md) - [Tip #87] MD5 is like a cockroach - it's persistent and pops up everywhere, but one thing is very clear: you need to stop using it (and SHA-1 too)!
- [In Depth: Pentesting Laravel part 2 - Configs, Dependencies, and Routes](https://securinglaravel.com/in-depth-pentesting-laravel-part-2-configs-dependencies-and-routes.md) - [In Depth #28] Continuing our Laravel Security Audit and Penetration Test, we're looking into configs and dependences, and following threads to discover 4 CRITICAL vulnerabilities!
- [Security Tip: What Is An HttpOnly Cookie?](https://securinglaravel.com/security-tip-what-is-an-httponly-cookie.md) - [Tip #86] Cookies come in many shapes and sizes, and with multiple attributes just to confuse you... Have you ever wondered what the humble HttpOnly attribute actually does?
- [Security Tip: Do You Have a Permissions Policy?](https://securinglaravel.com/security-tip-do-you-have-a-permissions-policy.md) - [Tip #85] What browser features do you have enabled on your site, and what can an XSS attack do if you don't disable them?
- [Security Tip: Don't Forget to Regenerate 2FA Secret Keys!](https://securinglaravel.com/security-tip-dont-forget-to-regenerate-2fa-secret-keys.md) - [Tip #84] It's not just passwords you need to worry about when it comes to authentication and stolen credentials: your 2FA secret keys may also be at risk!
- [In Depth: Pentesting Laravel part 1 - Passive Scans](https://securinglaravel.com/in-depth-pentesting-laravel-part-1-passive-scans.md) - [In Depth #27] Let me walk you through my process of conducting a Laravel Security Audit and Penetration Test, starting with the passive scans that usually find a lot of low-hanging fruit!
- [Security Tip: Prohibiting Destructive Commands on Production](https://securinglaravel.com/security-tip-prohibiting-destructive-commands-on-production.md) - [Tip #83] It's important to be paranoid when it comes to production environments - because if you forget you're logged into prod, you may end up dropping a database... or worse! 😱
- [Security Tip: How Strict Is your Transport Security?](https://securinglaravel.com/security-tip-how-strict-is-your-transport-security.md) - [Tip #82] HTTPS is everywhere & easy, but HTTP is still an option... How do you stop an attacker intercepting and downgrading connections to your site?
- [Security Tip: Is Your Referrer Leaking Information?](https://securinglaravel.com/security-tip-is-your-referrer-leaking-information.md) - [Tip #81] Do you know what information is being leaked by the Referer header when your users click on external links?
- [In Depth: Using CSS Clickjacking to Steal Passwords](https://securinglaravel.com/in-depth-css-clickjacking.md) - [In Depth #26] It's time for some nightmare fuel with a sneaky inline CSS vulnerability I found in a popular Laravel package!
- [Security Tip: Privilege Escalation Through Domain Wildcards!](https://securinglaravel.com/security-tip-privilege-escalation-through-domain-wildcards.md) - [Tip #80] It's incredibly common to find hardcoded domains used for identifying admins, however this also makes it trivial to escalate privileges to admin!
- [Security Tip: Only Use env() Within Config Files](https://securinglaravel.com/security-tip-only-use-env-within-config-files.md) - [Tip #79] It may be tempting to reach for env() outside your config files, but you may be introducing subtle bugs, or exposing your app to compromise...
- [Security Tip #78: Laravel 11's Per-Second Rate Limiting](https://securinglaravel.com/security-tip-laravel-11s-per-second.md) - Up until now, Laravel has only supported rate limiting per-minute, but that didn't work in some scenarios, as a minute is a very long time. To solve this, Laravel 11 supports per-second!
- [Security Tip: Laravel 11's Prompt Validation Rules](https://securinglaravel.com/security-tip-laravel-11s-prompt-validation.md) - [Tip #77] We often talk about validating user input from the browser, but what about user input on the command line? Validation is just as useful there too!
- [Security Tip: Laravel's Automatic Password Rehashing](https://securinglaravel.com/security-tip-laravel-11s-automatic.md) - [Tip #76] Let's check out three of the configuration options available as part of Automatic Password Rehashing: custom fields, disabling rehashing, and changing bcrypt rounds.
- [In Depth: Graceful Encryption Key Rotation](https://securinglaravel.com/in-depth-graceful-encryption-key.md) - [In Depth #25] Laravel makes effective use of encryption for security purposes, but what happens if your encryption key needs to be rotated? Let's see how Laravel 11 handles it...
- [Security Tip: Laravel 11's Controller Authorisation & Validation Methods](https://securinglaravel.com/security-tip-laravel-11s-controller.md) - [Tip#75] As part of the simplification of the app structure in Laravel 11, the Request Authorisation and Validation methods are no longer available on the controller - here's how you get it back.
- [Security Tip: Laravel 11's Middleware Configuration](https://securinglaravel.com/security-tip-laravel-11s-middleware.md) - [Tip#74] Laravel 11 shifts the default middleware into the framework itself and exposes configuration through the bootstrap/app.php class.
- [Security Tip: A Well-Known URL for Changing Passwords](https://securinglaravel.com/security-tip-a-well-known-url-for.md) - [Tip#73] You may have heard of the `/.well-known/` path, and the security.txt file, but there is a new one called `change-password` you should be aware of too!
- [In Depth: Registration Without Enumeration!](https://securinglaravel.com/in-depth-registration-without-enumeration.md) - [InDepth#24] It's time to answer the question: how do you build user registration and authentication without an enumeration vector?
- [Security Tip: Don't Forget Your Registration Form!](https://securinglaravel.com/security-tip-dont-forget-your-registration.md) - [Tip#72] We talk a lot about protecting password reset and login forms, but don't forget about the humble registration form, it can provide attackers with crucial intel!
- [Security Tip: Keep Your Tools Updated!](https://securinglaravel.com/security-tip-keep-your-tools-updated.md) - [Tip#71] We talk a lot about keeping our app dependencies updated, but we can't forget our tools like Composer also need updates too!
- [Security Tip: Fix Your Leaky APIs!](https://securinglaravel.com/security-tip-fix-your-leaky-apis.md) - [Tip#70] This is your periodic reminder to check your app for any leaky APIs and fix them ASAP, otherwise you might end up with an email from Have I Been Pwned's Troy Hunt...
- [In Depth: Protecting Staging Sites!](https://securinglaravel.com/in-depth-protecting-staging-sites.md) - [InDepth#23] Staging sites usually contain buggy code, debugging tools, and lower security than production, while also being a gateway into your environment and sometimes even contain customer data...
- [Security Tip: Use a Supported Version of Laravel!](https://securinglaravel.com/security-tip-use-a-supported-version.md) - [Tip#69] Are you using the latest version of Laravel? If not, do you have an upgrade planned?
- [Laravel Security: "Androxgh0st" Malware Targeting Laravel apps?](https://securinglaravel.com/laravel-security-androxgh0st-malware.md) - [Notice #2] What is this malware targeting Laravel, and should you be concerned about your apps?
- [Security Tip: Use the Alpine.js CSP Build!](https://securinglaravel.com/security-tip-use-the-alpinejs-csp.md) - [Tip#68] If you use Alpine and a CSP on your app, you'll want to use the new CSP-friendly build to avoid needing `unsafe-eval` in your policies.
- [Security Tip: Don't Use nl2br()!](https://securinglaravel.com/security-tip-dont-use-nl2br.md) - [Tip#67] As useful as it sounds, nl2br() can potentially leave you open to Cross-Site Scripting (XSS) vulnerabilities... you should reach for CSS instead!
- [In Depth: Introducing Random](https://securinglaravel.com/in-depth-introducing-random.md) - [InDepth#22] Random generates cryptographically secure random values in a range of different formats through a simple helper package for PHP.
- [Security Tip: Use HMAC Hashes To Verify Data](https://securinglaravel.com/security-tip-use-hmac-hashes-to-verify.md) - [Tip#66] For those situations where you need to generate a repeatable hash or signature, reach for HMAC, rather than MD5 or SHA1.
- [Security Tip: Do You Really Need a Hash for That?](https://securinglaravel.com/security-tip-do-you-really-need-a.md) - [Tip#65] Before you reach for a hashing function, stop and think about what you're hashing and why you're hashing it...
- [Security Tip: Escape Output with e(), htmlspecialchars(), & htmlentities()!](https://securinglaravel.com/security-tip-escape-output-with-e.md) - [Tip#64] Do you know the difference between `e()`, `htmlspecialchars()`, & `htmlentities()`? Can we just use `e()` for everything?
- [Security Tip: Is `strip_tags()` Secure?](https://securinglaravel.com/security-tip-is-strip_tags-secure.md) - [Tip#63] PHP includes a some really handy security-focused functions, but you need to know how to use them correctly, or you risk leaving a significant vulnerability waiting to be exploited! 😱
- [In Depth: Securing Apps on Forge](https://securinglaravel.com/in-depth-securing-apps-on-forge.md) - [InDepth#21] I've had this question many times, so let me take you through the steps I follow when provisioning and securing apps on Forge.
- [Security Tip: Protect Your .env File!](https://securinglaravel.com/security-tip-protect-your-env-file.md) - [Tip#62] Search engines like to snoop on all of your files, so be careful what you leave lying around.
- [Security Tip: Don't Log Sensitive Data!](https://securinglaravel.com/security-tip-dont-log-sensitive-data.md) - [Tip#61] While it's tempting to throw everything into logs, keep in mind where your logs end up → plain text files, 3rd party collectors, passed around the development team, etc...
- [Security Tip: Hide Sensitive Parameters from Stack Traces](https://securinglaravel.com/security-tip-hide-sensitive-parameters.md) - [Tip#60] Stack traces are essential for debugging complex (and even simple) issues, but there is a risk that something sensitive might be exposed within your trace... Let's ensure that doesn't happen!
- [Security Tip: Disable Debug Mode on World-accessible Apps](https://securinglaravel.com/security-tip-disable-debug-mode-on.md) - [Tip#59] It may seem obvious, you'd be surprised just how often I come across websites where debug mode is enabled!
- [In Depth: Adding Rehashing to Laravel](https://securinglaravel.com/in-depth-adding-rehashing-to-laravel.md) - [InDepth#20] It turns out Laravel was missing an important piece of it's Authentication system: password rehashing! Let's add that in and learn how the authentication system works in the process.
- [Security Tip: Increase Your bcrypt Rounds](https://securinglaravel.com/security-tip-increase-your-bcrypt.md) - [Tip#58] It's time to upgrade your bcrypt rounds to 12 (or higher)!
- [Security Tip: Watch Out for Command Injection](https://securinglaravel.com/security-tip-watch-out-for-command.md) - [Tip#57] You've heard about SQL Injection and Cross-Site Scripting but what about another big injection avenue: Command Injection? It's less common but just as critical that you're aware of it...
- [Security Tip: Compare keys with hash_equals()](https://securinglaravel.com/security-tip-compare-keys-with-hash_equals.md) - [Tip#56] It may be tempting to compare keys/sensitive strings using `===`, or even `==`, but that opens you up to timing attacks! You should be using a timing attack safe string comparison function...
- [2 years of Securing Laravel / Laravel Security In Depth!](https://securinglaravel.com/2-years-of-securing-laravel-laravel.md) - Thank you for subscribing and supporting Securing Laravel these past 2 years!
- [In Depth: "Th1nk Lik3 a H4cker" Walkthrough (part 2)](https://securinglaravel.com/in-depth-th1nk-lik3-a-h4cker-walkthrough-3f3.md) - [InDepth#19] It's time to finish up the "Th1nk Lik3 a H4cker" walkthrough, looking at the rest of the challenges and the final hack from Laracon US!
- [Security Tip: Avoiding Filename Collisions](https://securinglaravel.com/security-tip-avoiding-filename-collisions.md) - [Tip#55] Let's look at my old buddy time(), who always has something for me during my audits. This time it's helping avoid filename collisions?
- [Security Tip: Hijacking Domains, the Easy Way?](https://securinglaravel.com/security-tip-hijacking-domains-the.md) - [Tip#54] Don't leave domains (or subdomains) pointing at servers or nameservers you don't control, or you might get a copy of the email I just received! 😧
- [Security Tip: Bypassing CSRF Protection with File Uploads](https://securinglaravel.com/security-tip-bypassing-csrf-protection.md) - [Tip#53] Accepting File Uploads from your users is always a risky proposal, but have you considered just how easily uploaded files can be used to bypass CSRF and cookie protections?
- [In Depth: "Th1nk Lik3 a H4cker" Walkthrough (part 1)](https://securinglaravel.com/in-depth-th1nk-lik3-a-h4cker-walkthrough.md) - [InDepth#18] Let's take a walk through the first half of my "Th1nk Lik3 a H4cker" talk from Laracon EU & US. We'll explore the vulnerabilities behind each challenge and what I was trying to teach.
- [Security Tip: HTML autocomplete Attribute](https://securinglaravel.com/security-tip-html-autocomplete-attribute.md) - [Tip#52] HTML has a lot of hidden gems, and the `autocomplete` attribute is no exception. Lets take a look at how it helps your password fields and password managers work together!
- [Don't forget about the special Laracon US 25% Discount!](https://securinglaravel.com/dont-forget-about-the-special-laracon.md) - Only a couple of days left to take advantage of the 25% off special!
- [Securing Laravel → Special Laracon US 25% Discount!](https://securinglaravel.com/securing-laravel-special-laracon.md) - I'm on the plane headed to Laracon US, speaking on Thursday, which means it's time for my traditional "I'm speaking at Laracon" discount! 🥳
- [Security Tip: Validate Your Webhooks!](https://securinglaravel.com/security-tip-validate-your-webhooks.md) - [Tip#51] Just because your webhook endpoints aren't listed anywhere (are they?) doesn't mean someone won't find them, and send malicious payloads to your app! You need to validate your webhook payloads!
- [Security Tip: Watch out for Resource Authorisation](https://securinglaravel.com/security-tip-watch-out-for-resource.md) - [Tip#50] Watch out when you mix Resource Controllers and Authorisation with custom Controller Actions and custom routes... you may find you're lacking authorisation without realising it!
- [OpenLampTech - Developer Interview with Stephen Rees-Carter](https://securinglaravel.com/openlamptech-developer-interview.md)
- [Security Tip: Disable Dev Tools on Prod](https://securinglaravel.com/security-tip-disable-dev-tools-on.md) - [Tip#49] Dev tools are are really helpful, but they are still just dev tools. Don't install them on production... or anywhere world-accessible, if you can avoid it.
- [In Depth: Storing Environment Variables Safely](https://securinglaravel.com/in-depth-storing-environment-variables.md) - [InDepth#17] Let's dive deep into the wonderful world of storing environment variables safely, looking at the different options Laravel supports and some "industry best practices".
- [Security Tip: Test for Missing Authorisation](https://securinglaravel.com/security-tip-test-for-missing-authorisation.md) - [Tip#48] We write tests for everything else, so why not write tests for authorisation as well?
- [Security Tip: Getting Started with Content Security Policies](https://securinglaravel.com/security-tip-getting-started-with-csp.md) - [Tip#47] Setting up a CSP doesn't have to be a daunting task! Let's take a look at a tips for getting started with CSPs, without breaking anything!
- [Security Tip: Security Headers are Layers of Defence](https://securinglaravel.com/security-tip-security-headers-are.md) - [Tip#46] Security headers add important layers of defence to your apps, preventing data leaks, XSS and CSRF attacks, clickjacking, and more... Why are you leaving your apps unprotected?
- [Laravel Security In Depth → Securing Laravel](https://securinglaravel.com/laravel-security-in-depth-securing.md) - Let's talk about all the changes: new name, new domain, and a purple logo...
- [In Depth: What Are Insecure Functions?](https://securinglaravel.com/in-depth-what-are-insecure-functions.md) - [InDepth#16] According to random folks on the internet (i.e. social media), "insecure functions" are a wide and varied concept. Let's take a look at the common themes across the different ideas...
- [Security Tip: Replace Simple Dependencies](https://securinglaravel.com/security-tip-replace-simple-dependencies.md) - [Tip#45] The more dependencies your project has, the higher your risk of supply-chain attack is, and the less you're aware of what code is actually running...
- [Security Tip: Avoiding XSS with HtmlString](https://securinglaravel.com/security-tip-avoiding-xss-with-htmlstring.md) - [Tip#44] Check out that one simple trick... I mean... This is my favourite way to avoid XSS.
- [Security Tip: Don't Forget Rate Limiting](https://securinglaravel.com/security-tip-dont-forget-rate-limiting.md) - [Tip#43] It's essential for limiting bot attacks, and don't forget it on other sensitive routes like authentication...
- [In Depth: Mass-Assignment Vulnerabilities](https://securinglaravel.com/in-depth-mass-assignment-vulnerabilities.md) - [InDepth#15] There is a false confidence about mass-assignment vulnerabilities that hides how easy it is for them to occur and be exploited...
- [Security Tip: Validating Array Inputs](https://securinglaravel.com/security-tip-validating-array-inputs.md) - [Tip#42] Validating single values is easy, but what about arrays?
- [Security Tip: Safely Rendering JSON in Blade](https://securinglaravel.com/security-tip-safely-rendering-json.md) - [Tip#41] It's quite common to inject JSON into Blade templates for various use cases, but is it actually safe to do so? Not really...
- [In Depth: Securing Randomness Without Breaking Things](https://securinglaravel.com/in-depth-securing-randomness-without.md) - [InDepth#14] Cryptographically secure randomness is important, but so is backwards compatibility...
- [Security Tip: Retrieving Request Values](https://securinglaravel.com/security-tip-retrieving-request-values.md) - [Tip#40] Let's complete the set of request input helpers and their security implications
- [Security Tip: Casting Request Values](https://securinglaravel.com/security-tip-casing-request-values.md) - [Tip #39] Why treat all user input as strings when you can pull out specific values and automatically cast them as the types you're expecting?
- [Security Tip: Timebox for Timing Attacks](https://securinglaravel.com/security-tip-timebox-for-timing-attacks.md) - [Tip #38] Laravel is full of little helpers and features, and the Timebox is one that's often overlooked.
- [Security Tip: Laravel's Password Generator](https://securinglaravel.com/security-tip-new-password-generator.md) - [Tip#37] If you need to generate passwords in your app, it's important to use a cryptographically secure algorithm. Laravel makes this easy by giving us the Str::password() helper!
- [In Depth: Stealing Password Tokens with Forwarded Host Poisoning](https://securinglaravel.com/in-depth-stealing-password-tokens.md) - [InDepth#13] User input comes in many different forms, and sometimes your app will believe whatever your users tell it... especially if it's in a header!
- [Security Tip: Encoding/Serialising Data](https://securinglaravel.com/security-tip-encodingserialising.md) - [Tip#36] Encoding/serialising data can be risky if you're not using the correct functions.
- [Security Tip: Leaking Data After Changes](https://securinglaravel.com/security-tip-leaking-data-after-changes.md) - [Tip#35] It's easy to make innocent changes to one part of your app and forget to check how that flows into other parts of your app
- [Laracon EU 25% off discount 😉](https://securinglaravel.com/laracon-eu-25-off-discount.md) - Laracon EU has arrived, and I'm speaking tomorrow, which means it's time for another discount. 😉
- [Security Tip: Encrypting Environment Files?](https://securinglaravel.com/security-tip-encrypting-environment.md) - [Tip#34] Laravel features the ability to encrypt environment files... but do you need to use it?
- [In Depth: "Password Generator" Security Audit](https://securinglaravel.com/in-depth-password-generator-security.md) - [InDepth#12] In November 2022, Steve McDougall published a tutorial called "Creating a Password Generator"... we're going to audit his code!
- [Security Tip: Restricting Local File Access](https://securinglaravel.com/security-tip-restricting-local-file.md) - [Tip#33] We can easily restrict access to files on remote storage like S3, but what about local files?
- [Security Tip: Multiple Rate Limits](https://securinglaravel.com/security-tip-multiple-rate-limits.md) - [Tip#32] For times when one rate limit just won't do!
- [Security Tip: Canary Tokens](https://securinglaravel.com/security-tip-canary-tokens.md) - [Tip#31] These are my favourite simple security trick to let you know if someone is poking around in your stuff.
- [OWASP Tip: A10:2021 – Server-Side Request Forgery (SSRF)](https://securinglaravel.com/owasp-tip-a102021-server-side-request.md) - Our final entry in the OWASP Top 10 series - be aware of what your servers can access!
- [OWASP Tip: A09:2021 – Security Logging and Monitoring Failures](https://securinglaravel.com/owasp-tip-a092021-security-logging.md) - You do have logging enabled, right?
- [Don't forget about 25% off Laravel Security in Depth 😁](https://securinglaravel.com/dont-forget-about-25-off-laravel.md) - One last reminder about our Black Friday sale on Laravel Security in Depth subscriptions.
- [Laravel Security in Depth → Black Friday Special Offer](https://securinglaravel.com/laravel-security-in-depth-black-friday-bbc.md) - If you've been thinking of upgrading your Laravel Security in Depth subscription, now is the time!
- [OWASP In Depth: A08:2021 – Software and Data Integrity Failures](https://securinglaravel.com/owasp-in-depth-a082021-software-and.md) - It's a three-in-one for the third last entry into our OWASP Top 10 series!
- [Black Friday Special Offer (yes, I know, another one!)](https://securinglaravel.com/black-friday-special-offer-yes-i.md) - Get 25% off Laravel Security in Depth forever! 🥳
- [OWASP Tip: A07:2021 – Identification and Authentication Failures](https://securinglaravel.com/owasp-tip-a072021-identification.md) - Don't get confused with authorisation, we're talking authENTICation this week.
- [OWASP Tip: A06:2021 – Vulnerable and Outdated Components](https://securinglaravel.com/owasp-tip-a062021-vulnerable-and.md) - Keep your stuff updated!!
- [OWASP In Depth: A05:2021 – Security Misconfiguration](https://securinglaravel.com/owasp-in-depth-a052021-security-misconfiguration.md) - From Insecure Design last week to Insecure Configuration this week!
- [OWASP Tip: A04:2021 – Insecure Design](https://securinglaravel.com/owasp-tip-a042021-insecure-design.md) - It's hard to build a secure system if the design is inherently insecure.
- [OWASP Tip: A03:2021 – Injection](https://securinglaravel.com/owasp-tip-a032021-injection.md) - i.e. Cross-Site Scripting (XSS), SQL injection (SQLi), and Command Injection
- [OWASP Tip: A02:2021 – Cryptographic Failures](https://securinglaravel.com/owasp-tip-a022021-cryptographic-failures.md) - QmFzZSA2NCBpc24ndCBlbmNyeXB0aW9uIQ==
- [Don't miss the Laracon Online Discount!](https://securinglaravel.com/dont-miss-the-laracon-online-discount.md) - Subscribe now to get 25% off your Laravel Security In Depth subscription!
- [OWASP In Depth: A01:2021 - Broken Access Control](https://securinglaravel.com/owasp-in-depth-a012021-broken-access.md) - Let's dive into the first risk in the OWASP Top 10...
- [Laravel Security: OWASP Top 10 Overview](https://securinglaravel.com/laravel-security-owasp-top-10-overview.md) - What is the OWASP Top 10, and why is it important?
- [Security Tip: Finding Secrets](https://securinglaravel.com/security-tip-finding-secrets.md) - [Tip#30] Who wants to go on a treasure hunt for secrets, credentials, and API keys?
- [12 months of Laravel Security in Depth](https://securinglaravel.com/12-months-of-laravel-security-in.md) - Thank you all for an amazing journey!
- [Security Tip: Protecting Production APIs](https://securinglaravel.com/protecting-production-apis.md) - [Tip#29] Protecting the integrity of your data is just as important as stopping hackers.
- [Security Tip: composer audit](https://securinglaravel.com/security-tip-composer-audit.md) - [Tip#28] Composer 🥰
- [In Depth: Insecure Direct Object References (IDOR)](https://securinglaravel.com/in-depth-insecure-direct-object-references.md) - [InDepth#11] Also known as hide-and-seek, and security through obscurity!
- [Security Tip: Leaking Model Existence](https://securinglaravel.com/security-tip-leaking-model-existence.md) - [Tip#27] Observing the existence of something you can't access still tells you something important, even if you can't access it.
- [In Depth: Magic Emails](https://securinglaravel.com/in-depth-magic-emails.md) - [InDepth#10] One time codes, magic links, and more...
- [Security Tip: Watch Out for Type Juggling](https://securinglaravel.com/security-tip-type-juggling.md) - [Tip#26] Type Juggling is still very much a problem.
- [Security Tip: Login Logging](https://securinglaravel.com/security-tip-login-logging.md) - [Tip#25] Try saying that fast 3 times...
- [Security Tip: Use Route Groups!](https://securinglaravel.com/security-tip-use-route-groups.md) - [Tip#24] It may sound trivial, but it's easy to overlook.
- [Security Tip: Scoping Bindings](https://securinglaravel.com/security-tip-scoping-bindings.md) - [Tip#23] Because who doesn't love to scope their bindings?
- [In Depth: Signed URLs](https://securinglaravel.com/in-depth-signed-urls.md) - [InDepth#9] One of the many awesome and completely underrated Laravel security features.
- [Security Tip: Validating HTML & Markdown Input!](https://securinglaravel.com/security-tip-validating-html-and.md) - [Tip#22] Validating user input is easy to forget without adding HTML or Markdown into the mix!
- [Security Tip: Non-production Mail Sending](https://securinglaravel.com/security-tip-non-production-mail.md) - [Tip#21] It may seem strange but non-production mail can be a security risk.
- [Security Tip: Be Careful of Auth Helpers!](https://securinglaravel.com/security-tip-be-careful-of-auth-helpers.md) - [Tip#20] Laravel's helpers are great, but make sure you know everything they do before you use them.
- [In Depth: Policy Objects](https://securinglaravel.com/in-depth-policy-objects.md) - [InDepth#8] Policy Objects are incredibly powerful. Use them.
- [Security Tip: Cryptographically Secure Randomness](https://securinglaravel.com/security-tip-cryptographically-secure.md) - [Tip#19] Because all randomness should be cryptographically secure.
- [Security Tip: Keep Dependencies Updated](https://securinglaravel.com/security-tip-keep-dependencies-updated.md) - [Tip#18] Dependencies are security risks, especially if you have a lot of them or don't keep them updated...
- [In Depth: Content Security Policy](https://securinglaravel.com/in-depth-content-security-policy.md) - [InDepth#7] CSPs are an incredibly powerful security feature built into the browser.
- [Security Tip: Don't Hardcode Admin Emails](https://securinglaravel.com/security-tip-dont-hardcode-admin.md) - [Tip#17] It's easy to forget to update the admins list when it changes...
- [Security Tip: Avoid Open Redirects!](https://securinglaravel.com/security-tip-open-redirects.md) - [Tip#16] Ever clicked a link that looked legitimate, but took you somewhere unexpected?
- [In Depth: Timing Attacks](https://securinglaravel.com/in-depth-timing-attacks.md) - [InDepth#6] You can use response timing to infer important information.
- [Security Tip: Be Careful Of Transliteration](https://securinglaravel.com/security-tip-be-careful-of-transliteration.md) - [Tip#15] Since we don't have enough weird edge cases to worry about in security, here's one more: Transliteration allows you to bypass security checks when services like MySQL do magical translation without telling you! 😱
- [Security Tip: Use Subresource Integrity on Your Resources!](https://securinglaravel.com/security-tip-subresource-integrity.md) - [Tip#14] What is Subresource Integrity and why is it so important for securing your site?
- [In Depth: Rehashing Passwords](https://securinglaravel.com/in-depth-rehashing-passwords.md) - [InDepth#5] It sounds easy to rehash passwords, but is it really that easy?
- [Security Tip: Should You Block Compromised Passwords?](https://securinglaravel.com/security-tip-should-you-block-compromised.md) - [Tip#13] Blocking Compromised (Pwned) Passwords forces your users to use strong passwords, but is it the right choice for your app?
- [Security Tip: Rate Limit Your Login Forms!](https://securinglaravel.com/security-tip-rate-limited-logins.md) - [Tip#12] It's easy to guess passwords if your app doesn't rate limit attempts...
- [Security Tip: Default Password Rules](https://securinglaravel.com/security-tip-default-password-rules.md) - [Tip #11] Why duplicate password validation rules across your app when you can define defaults once?
- [In Depth #4: Guessing Placeholders For Malicious Purposes](https://securinglaravel.com/in-depth-guessing-placeholders.md) - Placeholders are incredibly useful, but you need to be careful with them.

## Optional
- [RSS Feed](https://securinglaravel.com/rss/)
- [Sitemap](https://securinglaravel.com/sitemap.xml)
- [Full content of pages and posts](https://securinglaravel.com/llms-full.txt)