Laravel應(yīng)用的安全防護(hù)需從多個(gè)層面入手，首先必須啟用CSRF保護(hù)，表單中使用@csrf指令確保令牌驗(yàn)證；2. 防止SQL注入應(yīng)優(yōu)先使用Eloquent或Query Builder，避免拼接用戶輸入的原生SQL，若必須使用則採(cǎi)用參數(shù)綁定；3. 防禦XSS攻擊時(shí)Blade模板默認(rèn)轉(zhuǎn)義輸出，禁用自動(dòng)轉(zhuǎn)義的{!! !!}僅用於可信內(nèi)容，並結(jié)合Purifier等庫(kù)淨(jìng)化富文本輸入；4. 所有輸入必須通過Laravel驗(yàn)證機(jī)制處理，使用validate方法或Form Request類，防止惡意數(shù)據(jù)進(jìn)入系統(tǒng)；5. 認(rèn)證安全方面應(yīng)使用Laravel內(nèi)置的Breeze、Jetstream或Fortify方案，密碼自動(dòng)哈希存儲(chǔ)，啟用登錄限流並強(qiáng)制HTTPS傳輸；6. 防止批量賦值漏洞需明確定義模型的$fillable或$guarded屬性，禁止直接傳遞$request->all()創(chuàng)建模型；7. 文件上傳功能要嚴(yán)格校驗(yàn)類型、大小和擴(kuò)展名，存儲(chǔ)路徑應(yīng)位於storage目錄並通過軟鏈接訪問，上傳文件重命名以防止路徑遍歷；8. 配置安全響應(yīng)頭如X-Content-Type-Options、X-Frame-Options、X-XSS-Protection，並推薦使用spatie/laravel-security-headers包統(tǒng)一管理；9. 定期更新Laravel核心及Composer/NPM依賴，利用composer audit、Dependabot等工具檢測(cè)已知漏洞；10. 生產(chǎn)環(huán)境配置必須設(shè)置APP_ENV=production、APP_DEBUG=false，生成強(qiáng)APP_KEY，禁止通過Web訪問.env和日誌文件，同時(shí)啟用HTTPS並設(shè)置SESSION_SECURE_COOKIE=true以保障會(huì)話安全。綜上所述，Laravel提供了全面的安全特性，關(guān)鍵在於正確啟用和配置這些機(jī)制，杜絕繞過防護(hù)和錯(cuò)誤配置導(dǎo)致的風(fēng)險(xiǎn)，最終實(shí)現(xiàn)系統(tǒng)的整體安全防護(hù)。

Securing a Laravel application involves addressing common web vulnerabilities through proper configuration, coding practices, and leveraging Laravel's built-in security features. Here's how to protect your Laravel app from the most frequent threats:

1. Prevent Cross-Site Request Forgery (CSRF)

Laravel includes CSRF protection out of the box using CSRF tokens. Always ensure your forms include the @csrf directive:

 <form method="POST" action="/profile">
    @csrf
    <!-- form fields -->
</form>

• Laravel automatically verifies the token for non-read HTTP requests (POST, PUT, DELETE).
• Never disable CSRF protection unless absolutely necessary (eg, public APIs), and even then, use API token-based authentication instead.

Note : If you're building a SPA or using API routes, use Laravel Sanctum or Passport for stateful authentication with proper token handling.

2. Protect Against SQL Injection

Laravel's Eloquent ORM and Query Builder automatically use PDO parameter binding, which prevents SQL injection— as long as you don't write raw SQL queries with user input .

? Safe:

 User::where('email', $request->email)->first();

? Risky:

 DB::select("SELECT * FROM users WHERE email = '" . $request->email . "'");

If you must use raw queries, use parameter binding:

 DB::select("SELECT * FROM users WHERE email = ?", [$request->email]);

Also, avoid using whereRaw , havingRaw , etc., with unescaped user input.

3. Prevent Cross-Site Scripting (XSS)

Blade templates automatically escape output using {{ }} , which helps prevent XSS:

 {{ $userInput }} <!-- Escaped by default -->

But be cautious with:

 {!! $userInput !!} <!-- NOT escaped – only use if you trust the content -->

If you allow users to submit HTML (eg, in a CMS), sanitize input using a library like mewebstudio/Purifier (Laravel Purifier) or league/commonmark with HTML sanitization.

Also, set appropriate Content-Security-Policy headers to restrict script sources.

4. Validate and Sanitize Input

Always validate incoming data using Laravel's validation features:

 $request->validate([
    'email' => 'required|email',
    'name' => 'required|string|max:255',
]);

Use validation rules like sanitized where needed, and avoid mass-assigning user input without defining $fillable or $guarded in models.

• Use form request validation for complex logic:

   php artisan make:request UpdateProfileRequest

5. Secure Authentication and Passwords

Laravel provides secure authentication scaffolding (via Laravel Breeze, Jetstream, or Fortify). Ensure you:

• Hash passwords using bcrypt() or Hash::make() (Laravel does this by default).
• Enforce strong passwords via validation.
• Enable rate limiting on login (built into Laravel).
• Use HTTPS in production to prevent credential sniffing.
• Consider multi-factor authentication (MFA) using Laravel Fortify or custom implementation.

Also, never log or store plain-text passwords or sensitive input.

6. Protect Against Mass Assignment

Avoid using ::create() or ::update() with raw request data:

? Risky:

 User::create($request->all());

? Safe:

 User::create($request->only('name', 'email'));

Or define $fillable or $guarded attributes in your model to control mass assignment.

7. Secure File Uploads

If allowing file uploads:

• Validate file type, size, and extension:

   $request->validate([
    'avatar' => 'required|image|max:2048',
  ]);

• Store files in storage/app/public and serve via symbolic links ( php artisan storage:link ).
• Avoid executing uploaded files by placing them outside the public directory when possible.
• Rename files to prevent path traversal or overwrites.

8. Set Proper Headers and Security Middleware

Use middleware to enforce security headers:

Install a package like spatie/laravel-security-headers or manually add headers in middleware:

 // In middleware or RouteServiceProvider
$response->headers->set('X-Content-Type-Options', 'nosniff');
$response->headers->set('X-Frame-Options', 'DENY');
$response->headers->set('X-XSS-Protection', '1; mode=block');

Also consider using CSP, HSTS, and Referrer-Policy headers.

9. Keep Dependencies Updated

Regularly update Laravel and all Composer/NPM dependencies:

 composer update
npm update

Use tools like:

• composer audit (or roave/security-advisories )
• Laravel Shift to automate upgrades
• Dependabot or Renovate for automated dependency monitoring

10. Environment and Configuration Security

• Set APP_ENV=production and APP_DEBUG=false in .env on live servers.
• Never commit .env to version control.
• Use strong APP_KEY (generate with php artisan key:generate ).
• Restrict access to storage/logs and .env via web server configuration.

Bonus: Use HTTPS and Secure Cookies

• Force HTTPS in production:

   // AppServiceProvider boot()
  URL::forceScheme('https');

• Set SESSION_SECURE_COOKIE=true in .env to send cookies over HTTPS only.

---

Basically, Laravel gives you strong tools out of the box—just use them correctly. Most vulnerabilities come from bypassing built-in protections or misconfigurations, not Laravel itself. Stay cautious with user input, keep things updated, and follow security best practices.

以上是如何從共同漏洞中獲得Laravel應(yīng)用程序？的詳細(xì)內(nèi)容。更多資訊請(qǐng)關(guān)注PHP中文網(wǎng)其他相關(guān)文章！