laravel-security
This skill guides you through hardening Laravel applications against common vulnerabilities. Learn to configure Sanctum and Passport for secure authentication, implement role-based access control with gates and policies, enforce HTTPS, manage sessions safely, and validate passwords against compromised databases.
Laravel Security provides authentication, authorization, and deployment hardening patterns to protect your application.
AI-generated summary based on this skill's SKILL.md
Install
affaan-m/ECC/laravel-security · repository language: JavaScript
git clone https://github.com/affaan-m/ECC
cp -r ECC/skills/laravel-security ~/.claude/skills/laravel-securitynpx skillfed install affaan-m/ECC/laravel-securityFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What are laravel security best practices I should follow?
laravel-security covers foundational hardening across authentication, input validation, and vulnerability prevention. Key practices include using Laravel's built-in authentication (Sanctum for SPAs, Passport for OAuth), enforcing HTTPS in production, validating all user input via Form Requests, protecting against mass assignment with fillable/guarded, hashing passwords with bcrypt or Argon2, regenerating sessions after login, and implementing CSRF tokens on all state-changing requests. Enable security headers (CSP, X-Frame-Options) and audit log critical events for compliance.
How do I prevent SQL injection in laravel eloquent queries?
laravel-security emphasizes that Eloquent's query builder and parameterized bindings protect against SQL injection by default. Always use Eloquent methods or query builder with placeholders (e.g., where('email', '=', $email)) rather than raw SQL. If you must use raw queries, bind parameters explicitly: DB::select('SELECT * FROM users WHERE id = ?', [$id]). Never concatenate user input directly into SQL strings. Validate and sanitize input before querying, and use Form Requests to enforce type and format rules.
What's the difference between Laravel Sanctum and Passport?
laravel-security distinguishes these authentication tools: Sanctum is lightweight, designed for SPAs and mobile apps using token-based or cookie-based authentication with CSRF protection built in. Passport implements OAuth 2.0 and is suited for issuing tokens to third-party applications. Choose Sanctum for your own frontend; choose Passport when external clients need delegated access. Both integrate with Laravel's authorization gates and policies for role-based access control.
How should I configure laravel environment variables and secrets?
laravel-security recommends storing all sensitive data (database credentials, API keys, encryption keys) in your .env file, never in code. Use env() helpers in config files to load them. In production, set environment variables via your hosting platform (not .env files). Rotate secrets regularly, use strong encryption keys (php artisan key:generate), and never commit .env to version control. Audit who has access to secrets and use a secrets manager for teams. Validate that APP_DEBUG is false and APP_ENV is 'production' before deploying.
How can I protect against CSRF and XSS attacks in Laravel?
laravel-security covers both: CSRF protection is automatic—Laravel generates tokens for all POST/PUT/DELETE requests; include @csrf in forms or send X-CSRF-TOKEN header in AJAX. XSS prevention relies on escaping output: use {{ }} (Blade's double-brace syntax) to HTML-escape user data by default; only use {!! !!} for trusted content. Implement Content Security Policy headers to restrict script sources. Validate and sanitize all input, reject unexpected data types, and use Form Requests for centralized validation rules.
What steps should I take before deploying a Laravel app to production?
laravel-security's deployment checklist includes: run php artisan config:cache and php artisan route:cache to optimize; set APP_DEBUG=false and APP_ENV=production; enforce HTTPS (set FORCE_HTTPS in config or use middleware); regenerate APP_KEY; disable unnecessary services; enable security headers (X-Frame-Options, X-Content-Type-Options); configure rate limiting on login and API endpoints; set up audit logging for security events; rotate database and API credentials; validate file upload restrictions; test CORS settings if serving an API; and monitor logs for suspicious activity.
SKILL.md
rendered from the published skill — quoted content, verbatim
Laravel Security Best Practices
Comprehensive security guidelines for Laravel applications to protect against common vulnerabilities.
When to Activate
- Setting up Laravel authentication and authorization (Sanctum, Passport, Jetstream, Breeze)
- Implementing user roles, permissions, and policies
- Configuring production security settings and environment variables
- Reviewing Laravel applications for security vulnerabilities
- Deploying Laravel applications to production
- Writing secure Eloquent queries and migrations
Production Configuration
Essential Production Settings
```php // config/app.php 'env' => env('APP_ENV', 'production'), 'debug' => (bool) env('APP_DEBUG', false), // CRITICAL: Never true in production 'key' => env('APP_KEY'), // Must be set: php artisan key:generate
// config/session.php 'secure' => env('SESSION_SECURE_COOKIE', true), 'http_only' => true, 'same_site' => 'lax',
// Verify APP_KEY is set at boot //
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 1 file
skills/laravel-security/SKILL.md