laravel-security

Laravel 13 Security

When to Use

Use this skill when building or auditing Laravel 13 applications for security. It covers mass assignment protection (Laravel 13 attributes), SQL injection prevention, XSS/PAO (PHP Attribute Output), CSRF, authentication (Breeze/Jetstream/Fortify), authorization (Gates/Polices), FormRequest validation, rate limiting, HTTP security headers, session security, CORS, file uploads, dependency auditing, APP_KEY rotation, and production hardening.

Mass Assignment Protection

Laravel 13 Attribute-Driven Mass Assignment

Laravel 13 uses PHP 8 attributes instead of $fillable / $guarded properties.

use Illuminate\Database\Eloquent\Attributes\Fillable;
use Illuminate\Database\Eloquent\Attributes\Guarded;
use Illuminate\Database\Eloquent\Model;

#[Fillable(['name', 'email', 'password'])]
class User extends Model {}

// Or use Guarded to exclude specific fields
#[Guarded(['is_admin'])]
class User extends Model {}

// Never use #[Unguarded] in production — it's the equivalent of turning off all protection
// #[Unguarded]  ← DANGEROUS

Legacy Property Approach (Still Works)

class User extends Model
{
    protected $fillable = ['name', 'email', 'password'];
    // protected $guarded = ['is_admin'];
}

Never Trust User Input for Mass Assignment

// DANGEROUS — user could pass is_admin: true
User::create($request->all());

// SAFE — only allow explicitly listed fields
User::create($request->only(['name', 'email', 'password']));

// SAFEST — use DTO
User::create($dto->toArray());

SQL Injection Prevention

Always Use Eloquent or Query Builder

// SAFE — Eloquent uses parameterized queries
$users = User::where('email', $request->input('email'))->get();

// SAFE — Query Builder uses parameterized queries
$users = DB::table('users')->where('email', $request->input('email'))->get();

// SAFE — Parameterized raw queries
$users = DB::select('SELECT * FROM users WHERE email = ?', [$request->input('email')]);

// SAFE — Named bindings
$users = DB::select('SELECT * FROM users WHERE email = :email', [
    'email' => $request->input('email'),
]);