> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: Pest's Security Preset & Strict Equality
- URL: https://securinglaravel.com/security-tip-pests-security-preset-strict-equality/
- Published: 2024-10-05T10:00:56.000Z
- Updated: 2024-10-07T23:15:20.000Z
- Description: [Tip #93] Test suites aren't just for raw code expectations, it turns out you can also use them to encourage secure coding practices!
- Author: Stephen Rees-Carter
- Tags: Security Tips, Testing, Type Juggling, Cryptography, Randomness

Most Laravel developers will have heard of [Pest](https://pestphp.com/?ref=securinglaravel.com), a new testing framework that's built on top of [PHPUnit](https://phpunit.de/?ref=securinglaravel.com) and provides a fluent API, plus a number of extra features and types beyond the basic text-expectation flow we're traditionally used to.

One of the cool aspects of Pest is being able to set expectations regarding code [architecture rules](https://pestphp.com/docs/arch-testing?ref=securinglaravel.com) \- ensuring your code is built in a specific way to keep it consistent and maintainable, as well as checking for common weaknesses and potentially vulnerable code in certain areas.

### Security Preset

My favourite Pest feature is the [Security Preset](https://pestphp.com/docs/arch-testing?ref=securinglaravel.com#content-security), which defines a set of security related expectations your application needs to follow.

Using the preset is trivial:

```php
arch()->preset()->security();
```

Pest security preset

At the time of writing, the preset blocks a number of [insecure functions](https://securinglaravel.com/in-depth-what-are-insecure-functions/) from being used in your application:

```php
$this->expectations[] = expect([
    'md5',
    'sha1',
    'uniqid',
    'rand',
    'mt_rand',
    'tempnam',
    'str_shuffle',
    'shuffle',
    'array_rand',
    'eval',
    'exec',
    'shell_exec',
    'system',
    'passthru',
    'create_function',
    'unserialize',
    'extract',
    'parse_str',
    'mb_parse_str',
    'dl',
    'assert',
])->not->toBeUsed();

```

[https://github.com/pestphp/pest/blob/3.x/src/ArchPresets/Security.php](https://github.com/pestphp/pest/blob/3.x/src/ArchPresets/Security.php?ref=securinglaravel.com)

This list should look pretty familiar, and these are common functions I flag all the time during security audits. If you enable this in your app, it'll force you to use proper hashing and secure randomness, which is always going to be a good thing, as well as encouraging you to use wrappers around commands and encoding, which should help avoid bigger issues.

While you're at it, check out the [PHP Preset](https://pestphp.com/docs/arch-testing?ref=securinglaravel.com#content-php), which blocks the use of debugging and depreciated functions. These [debugging functions](https://securinglaravel.com/tag/debug/) have security implications, so it's worth preventing their use too.

🤓

Pest's Security Preset [was added to Pest](https://github.com/pestphp/pest/pull/1174?ref=securinglaravel.com) by [Clara Leigh](https://x.com/clara%5Fleighw?ref=securinglaravel.com).

### Strict Equality

Alongside the Presets, you can also set general expectations, such as `toUseStrictEquality()`, which prevents you from using loose comparisons (`==` & `!=`) in your code.

```php
arch('models')
    ->expect('App')
    ->toUseStrictEquality();
```

[https://pestphp.com/docs/arch-testing#content-tousestrictequality](https://pestphp.com/docs/arch-testing?ref=securinglaravel.com#content-tousestrictequality)

This is another topic [I go on](https://securinglaravel.com/security-tip-compare-keys-with-hash%5Fequals/) [about](https://securinglaravel.com/in-depth-timing-attacks/), so it should come as no surprise to see it here (although it was only added to Pest in [v3.2.0 last week](https://github.com/pestphp/pest/releases/tag/v3.2.0?ref=securinglaravel.com)). There are very few downsides to using strict comparisons everywhere, given PHP still has fun [type juggling](https://securinglaravel.com/tag/type-juggling/) rules, so try and enable this one if you can.

Alright, that's my two recommendations for Pest's architecture tests! I must admit that I haven't had a chance to use them directly myself though, so please let me know if I've missed any, or if you have any other expectations you recommend.

---

**Found this security tip helpful?* Don't forget to* [*subscribe*](https://securinglaravel.com/#/portal/signup) *to receive new* [*Security Tips*](https://securinglaravel.com/tag/tips/) *each week, and upgrade to a* [*premium subscription*](https://securinglaravel.com/#/portal/signup) *to receive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*, or toss a coin in the* [*tip jar*](https://securinglaravel.com/#/portal/support)*.*

*Reach out if you're looking for a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com) *or a budget-friendly* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*, and find me on the various socials through* [*Pinkary*](https://pinkary.com/@valorin?ref=securinglaravel.com)*. Finally, don't forget to check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive security course.*