security

All my posts about security.

Composer 2.4 introduces two new commands: `bump` and `audit`

Aug 3rd 2022 – php.watch

The best dependency manager just got a little bit better.

New composer audit Command and security audits in Composer 2.4

Jul 8th 2022 – php.watch

Composer 2.4 features scanning the installed and new packages for known security vulnerabilities. When a new package is installed, or an existing package is updated, Composer looks up the package version numbers on known security vulnerability announcements, and reports if there are any known vulnerabilities in the list of packages.

Encrypting Laravel Eloquent models with CipherSweet

Jul 1st 2022 – rias.be

We've just released laravel-ciphersweet. This package is a wrapper over CipherSweet, which allows you to easily use it with Laravel's Eloquent models.

Using login links in a Laravel app original

May 30th 2022 by Freek Van der Herten – 3 minute read

I'm proud to announce that our team has launched a new package called spatie/laravel-login-link.

In this blog post, I'd like to tell you all about it.

How to improve privacy with Laravel file encryption

Mar 16th 2022 – geisi.dev - submitted by Tim Geisendörfer

Let's improve your users privacy with file encryption without using any 3rd party packages.

How I Got Pwned by My Cloud Costs

Jan 27th 2022 – www.troyhunt.com

Troy Hunt recently got a very high bill for his severless hosting. In this post, he share why the bill was so high, and how he's avoiding this for future bills.

Why I’m Using HTTP Basic Auth in 2022

Jan 12th 2022 – joeldare.com

If you're going to use basic auth, make sure that you use HTTPS.

Beg Bounties

Nov 18th 2021 – www.troyhunt.com

Troy Hunt with a good piece on people asking money in order to disclose a vulnerability. I get a lot of these too.

Replacing Keytar with Electron's safeStorage in Ray original

Oct 18th 2021 by Adriaan Marain – 3 minute read

Ray is an app we built at Spatie to make debugging your applications easier and faster. Being web developers, we naturally decided to write this app in Electron, which enabled us to move from nothing to a working prototype to a released product on 3 separate platforms within a matter of weeks.

Making 1Password understand where your change password page is located original

Oct 15th 2021 by Freek Van der Herten – 2 minute read

A few days ago, a new version of 1Password was released that is able to detect where a user can reset his or her password.

How to Use a Custom Encryption Key for Encrypted Cast Model Attributes in Laravel

Sep 8th 2021 – larasec.substack.com

Laravel allows you to cast model attributes as encrypted strings1, when stored in the database. This gives you added security for any values that are sensitive (such as Personally identifiable information, PII), including complex structures such as arrays, collections, and even objects.

Setting up and securing a private Composer repository

Jun 24th 2021 – alexvanderbist.com

Alex explains how we use Satis to give users of paid Spatie products access to private repos.

Custom Access Tokens in Laravel Sanctum

May 12th 2021 – doeken.org

Thanks to Doeke Norg personal access tokens became more flexible in Sanctum. In this blog post, he explains how you might use the new functionality

Dealing with expired signed URLs in Laravel original

May 6th 2021 by Freek Van der Herten – 2 minute read

Out of the box, Laravel comes with the ability to generate "signed" URLs. These URLs have a hash in their query string that verifies that the URL was not modified.

At Flare, we use these signed URLs to add action links in mail notifications. The action links allow users to snooze and resolve errors right from the mail without having to be logged in. Pretty convenient!

My buddy Dries Vints noticed a slight drawback. He got a mail from Flare that contains these action links. A few hours after the mail arrived, he clicked one of the action links. This is what he saw.

Freek.dev