laravel-security
This skill guides you through hardening Laravel applications against common vulnerabilities. Learn to configure Sanctum and Passport for secure authentication, implement role-based access control with gates and policies, enforce HTTPS, manage sessions safely, and validate passwords against compromised databases.
Laravel Security provides authentication, authorization, and deployment hardening patterns to protect your application.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-27
Laravel Security provides authentication, authorization, and deployment hardening patterns to protect your application. This skill guides you through hardening Laravel applications against common vulnerabilities. Learn to configure Sanctum and Passport for secure authentication, implement role-based access control with gates and policies, enforce HTTPS, manage sessions safely, and validate passwords against compromised databases.
Use it when
- laravel-security emphasizes that Eloquent's query builder and parameterized bindings protect against SQL injection by default.
- laravel-security distinguishes these authentication tools: Sanctum is lightweight.
Verify before relying
Read SKILL.md below before installing (1 file). Open directory: indexed for reading, not audited.
Install
affaan-m/ECC/laravel-security · repository language: JavaScript
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What are laravel security best practices I should follow?
laravel-security covers foundational hardening across authentication, input validation, and vulnerability prevention. Key practices include using Laravel's built-in authentication (Sanctum for SPAs, Passport for OAuth), enforcing HTTPS in production, validating all user input via Form Requests, protecting against mass assignment with fillable/guarded, hashing passwords with bcrypt or Argon2, regenerating sessions after login, and implementing CSRF tokens on all state-changing requests. Enable security headers (CSP, X-Frame-Options) and audit log critical events for compliance.
How do I prevent SQL injection in laravel eloquent queries?
laravel-security emphasizes that Eloquent's query builder and parameterized bindings protect against SQL injection by default. Always use Eloquent methods or query builder with placeholders (e.g., where('email', '=', $email)) rather than raw SQL. If you must use raw queries, bind parameters explicitly: DB::select('SELECT * FROM users WHERE id = ?', [$id]). Never concatenate user input directly into SQL strings. Validate and sanitize input before querying, and use Form Requests to enforce type and format rules.
What's the difference between Laravel Sanctum and Passport?
laravel-security distinguishes these authentication tools: Sanctum is lightweight, designed for SPAs and mobile apps using token-based or cookie-based authentication with CSRF protection built in. Passport implements OAuth 2.0 and is suited for issuing tokens to third-party applications. Choose Sanctum for your own frontend; choose Passport when external clients need delegated access. Both integrate with Laravel's authorization gates and policies for role-based access control.
How should I configure laravel environment variables and secrets?
laravel-security recommends storing all sensitive data (database credentials, API keys, encryption keys) in your .env file, never in code. Use env() helpers in config files to load them. In production, set environment variables via your hosting platform (not .env files). Rotate secrets regularly, use strong encryption keys (php artisan key:generate), and never commit .env to version control. Audit who has access to secrets and use a secrets manager for teams. Validate that APP_DEBUG is false and APP_ENV is 'production' before deploying.
How can I protect against CSRF and XSS attacks in Laravel?
laravel-security covers both: CSRF protection is automatic—Laravel generates tokens for all POST/PUT/DELETE requests; include @csrf in forms or send X-CSRF-TOKEN header in AJAX. XSS prevention relies on escaping output: use {{ }} (Blade's double-brace syntax) to HTML-escape user data by default; only use {!! !!} for trusted content. Implement Content Security Policy headers to restrict script sources. Validate and sanitize all input, reject unexpected data types, and use Form Requests for centralized validation rules.
What steps should I take before deploying a Laravel app to production?
laravel-security's deployment checklist includes: run php artisan config:cache and php artisan route:cache to optimize; set APP_DEBUG=false and APP_ENV=production; enforce HTTPS (set FORCE_HTTPS in config or use middleware); regenerate APP_KEY; disable unnecessary services; enable security headers (X-Frame-Options, X-Content-Type-Options); configure rate limiting on login and API endpoints; set up audit logging for security events; rotate database and API credentials; validate file upload restrictions; test CORS settings if serving an API; and monitor logs for suspicious activity.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Laravel Security Best Practices
Comprehensive security guidelines for Laravel applications to protect against common vulnerabilities.
When to Activate
- Setting up Laravel authentication and authorization (Sanctum, Passport, Jetstream, Breeze)
- Implementing user roles, permissions, and policies
- Configuring production security settings and environment variables
- Reviewing Laravel applications for security vulnerabilities
- Deploying Laravel applications to production
- Writing secure Eloquent queries and migrations
Production Configuration
Essential Production Settings
```php // config/app.php 'env' => env('APP_ENV', 'production'), 'debug' => (bool) env('APP_DEBUG', false), // CRITICAL: Never true in production 'key' => env('APP_KEY'), // Must be set: php artisan key:generate
// config/session.php 'secure' => env('SESSION_SECURE_COOKIE', true), 'http_only' => true, 'same_site' => 'lax',
// Verify APP_KEY is set at boot //
(truncated - see the full file via the links below)
File tree — 1 file
skills/laravel-security/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Implement secure authentication and authorization for Laravel apps”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Learn to implement authorization in Laravel using Gates for general ability checks and Policies for model-specific access rules. This skill covers middleware integration, Blade directives for conditional rendering, and Response objects for detailed permission messages. Includes testing strategies and best practices for securing controllers and form requests.
This skill teaches Laravel middleware architecture through practical patterns for request handling. Learn to build before and after middleware, implement terminable patterns for post-response tasks, organize middleware into groups, pass parameters to middleware, and apply common patterns like rate limiting, locale handling, and tenant scoping.
Get expert guidance on Laravel 12.x application development, from foundational concepts like routing and database migrations to advanced patterns including Eloquent relationships, API design, and authentication with Sanctum. This skill covers the full development lifecycle—models, validation, queues, dependency injection, and best practices for building scalable web applications.
Laravel Specialist guides you through designing and maintaining Laravel applications at production scale. It covers the full ecosystem—Eloquent relationships and query optimization, Blade and Livewire components, queue systems, middleware pipelines, and Pest testing—with a structured five-phase process from context discovery through optimization.
Laravel Cashier Stripe streamlines Stripe integration in Laravel apps with built-in subscription billing, recurring payments, and customer management. The skill covers setup, subscription lifecycle, payment methods, checkout flows, invoicing, and webhook handling—everything needed to add billing to your Laravel application.
Master Laravel's built-in internationalization system to support multiple languages from the ground up. Learn to configure locales, structure translation files, use helpers in controllers and templates, and implement advanced features like translatable model attributes and route localization.
More skills Laravel Cashier Paddle (unlicensed) · laravel-specialist (MIT) · laravel-11-12-app-guidelines (Apache-2.0) · Hunt Laravel (NOASSERTION)