Goodbye reCAPTCHA, hello Turnstile
We've been using this solution in our projects as well.
Read more [darkghosthunter.medium.com]
🚀 Laravel CSP v3 has been released, now supports presets
We just tagged & released a new major version of spatie/laravel-csp, a package to manage your Laravel app's content security policy. The development goal for version 3 was to reduce the boilerplate of configuring a policy for common services like Google Tag Manager, Fathom Analytics, Adobe Fonts…
Read more [spatie.be]
Join 9,500+ smart developers
Get my monthly newsletter with what I learn from running Spatie, building Oh Dear, and maintaining 300+ open source packages. Practical takes on Laravel, PHP, and AI that you can actually use.
No spam. Unsubscribe anytime. You can also follow me on X.
"Freek’s newsletter is one of the best ways to stay updated with the Laravel and PHP ecosystem. It consistently highlights useful packages, tools, and ideas from the community, especially the amazing work coming from Spatie. As a Laravel developer building SaaS and web platforms, I find it extremely helpful to discover practical tools and insights that improve my development workflow."
Introducing laravel-tfa-confirmation
– stefanzweifel.dev - submitted by Stefan Zweifel – Edit
A new Laravel package to protect sensitive routes or actions with a confirmation-screen and ask for the two-factor authentication code of a user.
Read more [stefanzweifel.dev]
Supercharging Rate Limiting with Cloudflare
By implementing rate limiting at the edge, “dead requests” can be reduced.
Read more [james.brooks.page]
Don't hardcode admin domains for auth
Stephen Rees-Carter tells how hardcoding admin domains in code can lead to security vulnerabilities
Read more [securinglaravel.com]
Using 1password for Laravel environment variables
– flareapp.io – Edit
Here's how we handle secrets at Flare
Read more [flareapp.io]
Livewire Strict: Enforce additional security measures to Livewire
– wire-elements.dev - submitted by Philo – Edit
Livewire Strict helps enforce security measures and prevents you from having unprotected sensitive public properties.
Read more [wire-elements.dev]
Encrypting Queued Jobs, Notifications, Mail, and Listeners in Laravel
– ashallendesign.co.uk - submitted by Ash Allen – Edit
Read about how to encrypt queued jobs, notifications, mailables, and listeners in Laravel for improved security.
Read more [ashallendesign.co.uk]
Protecting your email address via SVG instead of JS
A nice technique to prevent simple bots from harvesting your email address.
Read more [rouninmedia.github.io]
How we stopped a DDoS attack at Laracon
– flareapp.io - submitted by Spatie – Edit
Discover how we stopped a DDoS attack at Laracon!
Read more [flareapp.io]
Automatically Hash Laravel Model Values Using the "Hashed" Cast
– ashallendesign.co.uk - submitted by Ash Allen – Edit
Learn how to automatically hash sensitive data (such as passwords) using the "hashed" model cast in Laravel. This article also covers how to test your field is being hashed correctly.
Read more [ashallendesign.co.uk]
Making sure Laravel's debug mode is always disabled in production original
– ohdear.app – Edit
Recently, people started talking about a malware called “Androxgh0st” specifically targeting Laravel apps. In a recent edition of Securing Laravel, Stephen Rees-Carter wrote a good explanation of how it works. The malware targets apps with APP_DEBUG set to true. When enabled, Laravel will give…
Read more [ohdear.app]
Managing production environment variables for Laravel deployments
– flareapp.io – Edit
Here's how we handle our production secrets at Flare.
Read more [flareapp.io]
Sending a request with HMAC SHA256 signature using Postman
Here's how my colleague Ruben managed to do this in Flare.
Read more [rubenvanassche.com]
Packagist.org maintainer account takeover
Scary stuff, but handled very well by the Packagist team.
Read more [blog.packagist.com]
When to use Laravel global scopes
– stefrouschop.nl - submitted by Stef Rouschop – Edit
With a proper implementation of global scopes instead of local scopes, the code and security would be greatly improved. Let me illustrate this with a simple example.
Read more [stefrouschop.nl]
How to secure model ID’s in Livewire and why this is important
– stefrouschop.nl - submitted by Stef Rouschop – Edit
One caveat in Livewire (version 1 and 2) is that only public properties remain state between Livewire interactions. This shouldn’t be a problem, at least not if you’re aware of how a potential hacker would abuse this.
Read more [stefrouschop.nl]
Using Laravel Sanctum to create dynamic abilities original
by Freek Van der Herten – 12 minute read – Edit
In Oh Dear, we recently added the ability to create fine-grained API tokens that are scoped by a model. Behind the scenes, it uses Laravel Sanctum to create and verify abilities.
In this blog post, I'd like to give you a peek behind the scenes and show how we set this up.
Wildcard subdomain SSL certificates with Let's Encrypt and Bunny DNS
Creating wildcard subdomain SSL certificates isn't that straightforward with Let's encrypt as a normal SSL certificate.
Read more [rias.be]
Laravel's Safety Mechanisms
– planetscale.com - submitted by Aaron Francis – Edit
A comprehensive overview of Laravel's many safety features that can help you prevent painful mistakes.
Read more [planetscale.com]
