laravel

Laravel

Architecture

• Thin controllers: validate input, call service or action, return response. No business logic in controllers
• Form Requests for validation and authorisation. Never validate in controller body
• Service classes or Actions for domain logic. One responsibility each
• Repositories only when swapping data sources is a real requirement
• No logic in routes or middleware beyond stated purpose
• Strict mode in AppServiceProvider: Model::shouldBeStrict() in non-production, Model::preventLazyLoading() in all envs

PHP Attributes (Laravel 13+)

• PHP Attributes are optional but preferred for co-locating config with classes
• Models: #[Fillable], #[Guarded], #[Hidden] replace $fillable, $guarded, $hidden properties
• Controllers: #[Middleware], #[Authorize] replace $this->middleware() in constructor
• Jobs: #[Tries], #[Backoff], #[Timeout], #[FailOnTimeout] replace class properties
• Adopt Attributes on new code. No need to migrate existing property-based code — not deprecated

Eloquent

• Eager-load all relationships with with(). Enable Model::preventLazyLoading() to catch N+1 in dev
• Scope complex query logic into named scopes on the model
• firstOrFail() / findOrFail() — never manually null-check query results
• Mass assignment: #[Fillable] or explicit $fillable. Never $guarded = [] in production
• Observers and model events for cross-cutting concerns only. No core logic inside them
• DB::transaction(fn() => ...) for all multi-step writes
• UUID or ULID primary keys for distributed systems: HasUuids / HasUlids traits
• Always add indexes for foreign keys, frequently filtered columns, and unique constraints in migrations

Security

• Sanctum for SPA/mobile API auth. Passport for OAuth server. Never hand-rolled token auth
• Passkey auth available via Laravel 13 first-party support — prefer for new user-facing apps
• Authorise with Policies or Gates. Never inline ownership checks
• CSRF on by default — never disable
• Validate all input with Form Requests. Use sometimes and nullable intentionally
• Secrets in secret manager (AWS Secrets Manager, Vault). Never in .env committed to repo
• Encrypt sensitive data at rest via Crypt facade
• Rate-limit sensitive routes (login, register, password reset) with throttle middleware
• Never DB::statement() with user input. Use query builder or Eloquent
• Sanctum tokens: set expiry. Revoke on logout. Store hashed in DB (default behaviour — don't bypass)