security

Learn how to automatically hash sensitive data (such as passwords) using the "hashed" model cast in Laravel. This article also covers how to test your field is being hashed correctly.

Making sure Laravel's debug mode is always disabled in production original

Jan 22nd 2024 – ohdear.app

Recently, people started talking about a malware called “Androxgh0st” specifically targeting Laravel apps. In a recent edition of Securing Laravel, Stephen Rees-Carter wrote a good explanation of how it works. The malware targets apps with APP_DEBUG set to true. When enabled, Laravel will give…

Managing production environment variables for Laravel deployments

Jul 25th 2023 – flareapp.io

Here's how we handle our production secrets at Flare.

Sending a request with HMAC SHA256 signature using Postman

Jun 26th 2023 – rubenvanassche.com

Here's how my colleague Ruben managed to do this in Flare.

Packagist.org maintainer account takeover

May 3rd 2023 – blog.packagist.com

Scary stuff, but handled very well by the Packagist team.

When to use Laravel global scopes

Feb 22nd 2023 – stefrouschop.nl - submitted by Stef Rouschop

With a proper implementation of global scopes instead of local scopes, the code and security would be greatly improved. Let me illustrate this with a simple example.

How to secure model ID’s in Livewire and why this is important

Feb 13th 2023 – stefrouschop.nl - submitted by Stef Rouschop

One caveat in Livewire (version 1 and 2) is that only public properties remain state between Livewire interactions. This shouldn’t be a problem, at least not if you’re aware of how a potential hacker would abuse this.

Using Laravel Sanctum to create dynamic abilities original

Feb 8th 2023 by Freek Van der Herten – 12 minute read

In Oh Dear, we recently added the ability to create fine-grained API tokens that are scoped by a model. Behind the scenes, it uses Laravel Sanctum to create and verify abilities.

In this blog post, I'd like to give you a peek behind the scenes and show how we set this up.

Wildcard subdomain SSL certificates with Let's Encrypt and Bunny DNS

Nov 1st 2022 – rias.be - submitted by Rias

Creating wildcard subdomain SSL certificates isn't that straightforward with Let's encrypt as a normal SSL certificate.

Laravel's Safety Mechanisms

Oct 20th 2022 – planetscale.com - submitted by Aaron Francis

A comprehensive overview of Laravel's many safety features that can help you prevent painful mistakes.

Providing faster support using auto-impersonation original

Oct 11th 2022 by Freek Van der Herten – 6 minute read

In the SaaS'es I usually work on (Flare, Mailcoach Cloud, Oh Dear), we've recently introduced an improvement to how we handle support. We call it "auto-impersonation".

In this blog post, I'd like to tell you all about it.

Freek.dev

security

Don't hardcode admin domains for auth

Using 1password for Laravel environment variables

Livewire Strict: Enforce additional security measures to Livewire

Encrypting Queued Jobs, Notifications, Mail, and Listeners in Laravel

Protecting your email address via SVG instead of JS

How we stopped a DDoS attack at Laracon

Automatically Hash Laravel Model Values Using the "Hashed" Cast