Laravel Security Through Examples
In this series, we'll use examples of weaknesses and vulnerabilities that are commonly found in Laravel applications to illustrate the variety of security concerns you need to be aware of as a Laravel developer. This includes general SQL injection attacks, serialization, validation, and much more. Ready to get started?
Progress
Series Info
- Episodes
- 12
- Run Time
- 2h 37m
- Difficulty
- Intermediate
- Last Updated
- Mar 9, 2023
- Version
- Latest
Series Episodes
- Episodes (12)
Deploying Securely
To kick off this series, we'll review some of the basics that you absolutely need to be doing when making your app world-accessible.Missing Authorisation
In this episode, we'll look at a very common weakness I've found in most apps that I've audited: missing authorisation.Validation
Next, let's discuss why validating user input is so vitally important for protecting your applications. We'll also touch on password rules, mass assignment limitations, and more!SQL Injection, Sqlmap, and the Apostrophe Trick
It's easy to overlook SQL injection when you use a fully-featured ORM like Eloquent, but SQLi vulnerabilities can still sneak in if you're not careful. In this lesson, I'll demonstrate the single apostraphe trick, and how to use sqlmap to find SQLi vulnerabilities.Never Trust User Input
This next lesson illustrates one of the most important pieces of security advice that I can offer you. Never, ever trust user input. Let's explore why!Markdown Security Concerns
I've got some bad news for you... Markdown isn't safe! Well, at least not by default. Let's take a look at why and how we can make Markdown safe to use in your own projects.Sensitive Attributes
It's important to remember that passing data to the browser as part of an API call is very different from rendering a server-side application. If you need to pass data to the browsert, you must be aware of which data you're actually passing.Why Rate Limiting is a Must
Let's next have a look at what rate limiting is, and why it's so critical to the security of your applications. Without it, I'll show you a variety of examples of how common passwords can be brute-forced.Signed Routes
Let's next dive into one of my favorite Laravel features: signed routes! These make it incredibly easy to protect and secure sensitive routes with only two lines.Type Juggling
Not only is type juggling one of PHP's superpowers, but it's also, if you're not careful, one of its biggest weaknesses. Let's explore why, the pitfalls of PHP 7.4, and what the upgrade to PHP 8 changed.The Only Cryptographically Secure Random Functions You'll Ever Need
It's important to learn from other's mistakes, so let's take a look at a few simple but critical flaws that I've encountered with "crypto."Deserialisation Attacks...and the Solution
Let's finish up by exploring a deserialisation attack and how it works in the context of a PHP application. We'll use this attack to gain shell access to a user's machine.
