The security protection of Laravel applications needs to start from multiple levels. First, CSRF protection must be enabled, and the @csrf directive must be used in the form to ensure token verification; 2. Eloquent or Query Builder should be used to prevent SQL injection to avoid splicing native SQL input by user, and parameter binding should be used if necessary; 3. When defending against XSS attacks, the Blade template escapes the output by default, and the {!!!} that is automatically escaped is disabled for trusted content, and it is used in combination with Purifier and other libraries to purify rich text input; 4. All inputs must be processed through the Laravel verification mechanism, using the validate method or Form Request class to prevent malicious data from entering the system; 5. In terms of authentication security, Laravel's built-in Breeze, Jetstream or Fortify schemes should be used, passwords are automatically hashed, login limiting and HTTPS transmission is enabled; 6. To prevent batch assignment vulnerabilities, you need to clearly define the $fillable or $guarded attributes of the model, and it is prohibited to directly pass $request->all() to create a model; 7. The file upload function must strictly verify the type, size and extension, the storage path should be located in the storage directory and accessed through soft links, and upload files to rename to prevent path traversal; 8. Configure security response headers such as X-Content-Type-Options, X-Frame-Options, and X-XSS-Protection, and it is recommended to use the spatie/laravel-security-headers package to manage uniformly; 9. Regularly update the Laravel core and Composer/NPM dependencies, and use composer audit, Dependabot and other tools to detect known vulnerabilities; 10. In the production environment configuration, you must set APP_ENV=production, APP_DEBUG=false to generate strong APP_KEY, prohibit accessing .env and log files through the web, and enable HTTPS and set SESSION_SECURE_COOKIE=true to ensure session security. To sum up, Laravel provides comprehensive security features. The key is to correctly enable and configure these mechanisms, eliminate the risks caused by bypassing protection and incorrect configuration, and ultimately realize the overall security protection of the system.

Securing a Laravel application involves addressing common web vulnerabilities through proper configuration, coding practices, and leveraging Laravel's built-in security features. Here's how to protect your Laravel app from the most frequent threats:

1. Prevent Cross-Site Request Forgery (CSRF)

Laravel includes CSRF protection out of the box using CSRF tokens. Always ensure your forms include the @csrf directive:

 <form method="POST" action="/profile">
    @csrf
    <!-- form fields -->
</form>

• Laravel automatically verifies the token for non-read HTTP requests (POST, PUT, DELETE).
• Never disable CSRF protection unless absolutely necessary (eg, public APIs), and even then, use API token-based authentication instead.

Note : If you're building a SPA or using API routes, use Laravel Sanctum or Passport for stateful authentication with proper token handling.

2. Protect Against SQL Injection

Laravel's Eloquent ORM and Query Builder automatically use PDO parameter binding, which prevents SQL injection— as long as you don't write raw SQL queries with user input .

? Safe:

 User::where('email', $request->email)->first();

? Risky:

 DB::select("SELECT * FROM users WHERE email = '" . $request->email . "'");

If you must use raw queries, use parameter binding:

 DB::select("SELECT * FROM users WHERE email = ?", [$request->email]);

Also, avoid using whereRaw , havingRaw , etc., with unescaped user input.

3. Prevent Cross-Site Scripting (XSS)

Blade templates automatically escape output using {{ }} , which helps prevent XSS:

 {{ $userInput }} <!-- Escaped by default -->

But be cautious with:

 {!! $userInput !!} <!-- NOT escaped – only use if you trust the content -->

If you allow users to submit HTML (eg, in a CMS), sanitize input using a library like mewebstudio/Purifier (Laravel Purifier) or league/commonmark with HTML sanitization.

Also, set appropriate Content-Security-Policy headers to restrict script sources.

4. Validate and Sanitize Input

Always validate incoming data using Laravel's validation features:

 $request->validate([
    'email' => 'required|email',
    'name' => 'required|string|max:255',
]);

Use validation rules like sanitized where needed, and avoid mass-assigning user input without defining $fillable or $guarded in models.

• Use form request validation for complex logic:

   php artisan make:request UpdateProfileRequest

5. Secure Authentication and Passwords

Laravel provides secure authentication scaffolding (via Laravel Breeze, Jetstream, or Fortify). Ensure you:

• Hash passwords using bcrypt() or Hash::make() (Laravel does this by default).
• Enforce strong passwords via validation.
• Enable rate limiting on login (built into Laravel).
• Use HTTPS in production to prevent credential sniffing.
• Consider multi-factor authentication (MFA) using Laravel Fortify or custom implementation.

Also, never log or store plain-text passwords or sensitive input.

6. Protect Against Mass Assignment

Avoid using ::create() or ::update() with raw request data:

? Risky:

 User::create($request->all());

? Safe:

 User::create($request->only('name', 'email'));

Or define $fillable or $guarded attributes in your model to control mass assignment.

7. Secure File Uploads

If allowing file uploads:

• Validate file type, size, and extension:

   $request->validate([
    'avatar' => 'required|image|max:2048',
  ]);

• Store files in storage/app/public and serve via symbolic links ( php artisan storage:link ).
• Avoid executing uploaded files by placing them outside the public directory when possible.
• Rename files to prevent path traversal or overwrites.

8. Set Proper Headers and Security Middleware

Use middleware to enforce security headers:

Install a package like spatie/laravel-security-headers or manually add headers in middleware:

 // In middleware or RouteServiceProvider
$response->headers->set('X-Content-Type-Options', 'nosniff');
$response->headers->set('X-Frame-Options', 'DENY');
$response->headers->set('X-XSS-Protection', '1; mode=block');

Also consider using CSP, HSTS, and Referrer-Policy headers.

9. Keep Dependencies Updated

Regularly update Laravel and all Composer/NPM dependencies:

 composer update
npm update

Use tools like:

• composer audit (or roave/security-advisories )
• Laravel Shift to automate upgrades
• Dependabot or Renovate for automated dependency monitoring

10. Environment and Configuration Security

• Set APP_ENV=production and APP_DEBUG=false in .env on live servers.
• Never commit .env to version control.
• Use strong APP_KEY (generate with php artisan key:generate ).
• Restrict access to storage/logs and .env via web server configuration.

Bonus: Use HTTPS and Secure Cookies

• Force HTTPS in production:

   // AppServiceProvider boot()
  URL::forceScheme('https');

• Set SESSION_SECURE_COOKIE=true in .env to send cookies over HTTPS only.

---

Basically, Laravel gives you strong tools out of the box—just use them correctly. Most vulnerabilities come from bypassing built-in protections or misconfigurations, not Laravel itself. Stay cautious with user input, keep things updated, and follow security best practices.

The above is the detailed content of How to secure a Laravel application from common vulnerabilities?. For more information, please follow other related articles on the PHP Chinese website!