Security best practices in Laravel - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is CSRF protection in Laravel?

CSRF (Cross-Site Request Forgery) protection prevents unauthorized commands from being transmitted from a user that the web application trusts. Laravel uses a CSRF token in forms to verify requests are genuine.

beginner

How does Laravel help prevent SQL Injection?

Laravel uses prepared statements and query builder which automatically bind parameters. This prevents attackers from injecting malicious SQL code.

beginner

Why should you never store passwords in plain text in Laravel?

Storing passwords in plain text risks user data if the database is leaked. Laravel provides bcrypt hashing to securely store passwords so they cannot be read directly.

intermediate

What is the purpose of Laravel's 'Encrypt Cookies' middleware?

It encrypts cookies so that their contents cannot be read or tampered with by users, protecting sensitive data stored in cookies.

intermediate

How can you secure file uploads in Laravel?

Validate file types and sizes, store files outside the public directory, and use Laravel's storage system to control access. This prevents malicious files from harming the app.

Which Laravel feature helps prevent Cross-Site Request Forgery attacks?

A Blade templating

B Eloquent ORM

C CSRF token

D Route caching

CSRF tokens are used to verify that form submissions come from your application, preventing CSRF attacks.

What does Laravel use to securely hash passwords?

A SHA1

B MD5

C Base64

D bcrypt

Laravel uses bcrypt hashing which is strong and slow, making password cracking difficult.

How does Laravel protect against SQL Injection?

A Using prepared statements and query builder

B Encrypting database tables

C Disabling database access

D Using raw SQL queries only

Prepared statements separate SQL code from data, preventing injection attacks.

Which middleware encrypts cookies in Laravel?

A EncryptCookies

B VerifyCsrfToken

C Authenticate

D ThrottleRequests

EncryptCookies middleware encrypts cookie data to protect it from tampering.

What is a good practice for securing file uploads in Laravel?

A Store files in public directory

B Validate file type and size

C Allow all file types

D Disable file uploads

Validating file type and size helps prevent malicious files from being uploaded.

Explain how Laravel protects your application from Cross-Site Request Forgery (CSRF) attacks.

Think about how Laravel checks that form submissions are from your app.

Describe best practices for handling user passwords securely in Laravel.

Focus on how passwords should be stored and why.