Laravel protects you from many common attacks by default: prepared statements guard against SQL injection, Blade escapes output, forms include CSRF tokens and passwords are hashed. These defaults only help if you do not bypass them. This checklist covers what we review on client projects before launch and during maintenance. It is a practical starting point, not a replacement for a full security assessment.
Authentication and sessions
Passwords and sign-in
- Use Laravel's hashing, never your own scheme, and enforce a sensible minimum password length.
- Rate limit login, password reset and one-time-code endpoints to slow down guessing.
- Offer two-factor authentication for administrators and anyone with access to sensitive data.
- Regenerate the session on login and invalidate it on logout.
Cookies and sessions
Serve the application only over HTTPS, mark session cookies as secure and HTTP-only, and choose a suitable same-site setting. Keep session lifetimes reasonable for the sensitivity of the data, and shorten them for administrative areas.
Authorization: who may do what
Broken access control is among the most common serious flaws, and it is easy to introduce. A user changes an identifier in a URL and sees another customer's invoice. Prevent it systematically.
- Define policies for each model and call them in controllers, form requests or route middleware.
- Scope queries to the current user or tenant instead of fetching by identifier alone.
- Check permissions on the server for every action, even if the button is hidden in the interface.
- Write feature tests that prove a user cannot read or change another user's records.
In multi-tenant products such as our VnuMngr venue platform, tenant isolation tests are among the first tests we write.
Input, output and files
Validate everything that comes in
Use form requests with explicit rules for type, length and allowed values. Use the validated data, not the raw request, when creating records, and define fillable attributes on models to prevent mass assignment of fields such as roles or prices.
Treat rich text with care
Where users or editors submit HTML, sanitise it with an allow-list of tags and attributes before saving, and never render untrusted HTML unescaped. Our own blog applies this approach to every article body.
Handle uploads safely
Validate file type and size, generate your own file names, and store uploads outside the public directory unless they are meant to be public. Serve private files through authorised routes or short-lived signed URLs. Never execute or include uploaded files.
Secrets, configuration and dependencies
Keep secrets out of the code
Store keys, passwords and tokens in environment variables or a secrets manager, never in the repository. Set the debug flag to false in production, because debug pages reveal configuration and code. Rotate credentials when staff leave or when exposure is suspected, and encrypt sensitive values stored in the database.
Update dependencies regularly
Most breaches exploit known flaws in outdated software. Keep Laravel, PHP and packages up to date, run composer audit as part of your pipeline, and remove packages you no longer use. Do the same for your front-end packages.
Infrastructure and operations
Harden the server
Expose only the ports you need, keep the operating system patched, run the application under a limited user, and block access to hidden files and the application's internal directories. Point the web server's document root at the public directory only.
Add protective headers
Send security headers such as a content security policy, frame protection, content type protection and a strict transport security policy. Introduce a content security policy carefully, because a rushed policy can break legitimate scripts.
Log, monitor and back up
Record security-relevant events such as failed logins, permission changes and exports of large data sets. Alert on unusual patterns. Keep encrypted backups in a separate location and test restoring them, because a backup is also your recovery plan after an incident.
A final review list
- Debug is off and HTTPS is enforced in production.
- Every route that returns private data is protected by authentication and authorization.
- All input is validated and models guard against mass assignment.
- Uploads are validated and stored safely.
- Secrets are outside the repository and rotated when needed.
- Dependencies are audited and updated on a schedule.
- Logs and alerts exist, and backups have been restored at least once in testing.
Security is a habit, not a one-off task. If you would like an independent review of your Laravel application, or a team to build security into your next project, see our services or talk to Narmar.
