Laravel
3 articles with this tag
Laravel security — a production hardening reference
Laravel's defaults are strong; production incidents come from config and operations. This is a working reference: (1) a priority-ordered hardening checklist (P0–P2), (2) a table of dangerous defaults, (3) per-area guidance — secrets/APP_KEY, production config (APP_DEBUG/caching), authorization (Policy/Gate, Mass Assignment), injection/output (Eloquent binding, Blade), sessions/CSRF/cookies, uploads, HTTPS/headers/rate limiting, Composer dependency CVEs, and (4) a self-verification checklist. Defensive only — no attack steps.
A case where Laravel's .env was publicly readable: a shared-hosting placement mistake and how to fix it
The cause: the whole app sat under the web root; only public/ should be visible. Fix in three steps — a temporary .htaccess block, rotate keys, restructure — then prevent it with process.
Keeping .env off the public web on shared hosting
The main fix: app body outside the docroot, only public/ exposed. Block access with .htaccess first, make it permanent by restructuring, then self-check. This site's view: this isn't one person's slip but a dangerous layout that became standard across the industry — fix it with process, not vigilance. bootstrap-redirect beats symlink.