Security best practices in Laravel - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to protect a route with authentication middleware in Laravel.

Laravel

Route::get('/dashboard', function () {
    return view('dashboard');
})->middleware('[1]');

Drag options to blanks, or click blank then click option'

Aapi

Bguest

Cweb

Dauth

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'guest' middleware which allows only unauthenticated users.

Using 'api' middleware which is for API routes, not authentication.

Using 'web' middleware which is a group, not specifically for auth.

The auth middleware ensures only authenticated users can access the route.

2fill in blank

medium

Complete the code to hash a password before saving it in Laravel.

Laravel

$user->password = [1]($request->password);

Drag options to blanks, or click blank then click option'

Amd5

Bbcrypt

Csha1

Dhash

Attempts:

3 left

💡 Hint

Common Mistakes

Using insecure hash functions like md5 or sha1.

Using 'hash' without specifying algorithm.

Not hashing the password at all.

Laravel uses bcrypt to securely hash passwords before storing them.

3fill in blank

hard

Fix the error in the CSRF token field in a Blade form.

Laravel

<form method="POST" action="/submit">
    [1]
    <input type="text" name="name">
    <button type="submit">Submit</button>
</form>

Drag options to blanks, or click blank then click option'

A@csrf

B@csrf_token

C{{ csrf_field() }}

D@token

Attempts:

3 left

💡 Hint

Common Mistakes

Using '@csrf_token' which is not a valid directive.

Using '{{ csrf_field() }}' inside Blade without echoing properly.

Using '@token' which does not exist.

In Blade templates, @csrf is the directive to include the CSRF token field.

4fill in blank

hard

Fill both blanks to validate input and prevent SQL injection in Laravel.

Laravel

public function store(Request $request) {
    $validated = $request->validate([[1] => 'required|string|max:255']);
    User::create([[2] => $validated['name']]);
}

Drag options to blanks, or click blank then click option'

A'name'

B'email'

C'password'

D'username'

Attempts:

3 left

💡 Hint

Common Mistakes

Using different keys for validation and creation causing errors.

Using keys unrelated to the input field.

Both blanks use the key 'name' to validate and save the user's name safely.

5fill in blank

hard

Fill the blanks to safely retrieve user input, validate it, and hash the password.

Laravel

public function register(Request $request) {
    $data = $request->only([1], [2]);
    $validated = $request->validate([
        [1] => 'required|string|max:255',
        [2] => 'required|string|min:8'
    ]);
    $user = User::create([
        [1] => $validated['name'],
        [2] => bcrypt($validated['password'])
    ]);
}

Drag options to blanks, or click blank then click option'

A'name'

B'password'

C'email'

D'username'

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up field names causing validation or saving errors.

Not hashing the password before saving.

The code safely gets 'name' and 'password', validates them, and hashes the password before saving.

Practice

1. Which Laravel feature helps protect your application from Cross-Site Request Forgery (CSRF) attacks?

easy

A. Storing passwords in plain text

B. Using raw SQL queries without bindings

C. CSRF tokens automatically added to forms

D. Disabling middleware in routes

Solution

1. Step 1: Understand CSRF attacks

   CSRF attacks trick users into submitting unwanted requests. Laravel uses tokens to prevent this.

2. Step 2: Identify Laravel's protection method

   Laravel automatically adds CSRF tokens to forms and verifies them on submission.

3. Final Answer:

   CSRF tokens automatically added to forms -> Option C

4. Quick Check:

   CSRF protection = CSRF tokens [OK]

Hint: CSRF protection means using tokens in forms [OK]

Common Mistakes:

• Thinking raw SQL protects against CSRF
• Disabling middleware removes security
• Storing passwords in plain text is unsafe

2. Which of the following is the correct way to hash a password before saving it in Laravel?

easy

A. $hashed = Hash::make($password);

B. $hashed = bcrypt($password);

C. $hashed = md5($password);

D. $hashed = base64_encode($password);

Solution

1. Step 1: Identify Laravel's recommended password hashing

   Laravel provides the Hash facade's make method for secure password hashing.

2. Step 2: Compare options

   $hashed = Hash::make($password); is the recommended and most flexible method. bcrypt() helper is valid but less flexible. md5 and base64_encode are insecure.

3. Final Answer:

   $hashed = Hash::make($password); -> Option A

4. Quick Check:

   Password hashing = Hash::make() [OK]

Hint: Use Hash::make() for password hashing in Laravel [OK]

Common Mistakes:

• Using insecure md5 or base64_encode
• Confusing Hash::make without import
• Saving passwords without hashing

3. Consider this Laravel route definition:

Route::middleware(['auth'])->group(function () {
    Route::get('/dashboard', function () {
        return 'Welcome to your dashboard';
    });
});

What will happen if a guest (not logged in) tries to access /dashboard?

medium

A. They will see the dashboard message

B. They will be redirected to the login page

C. They will get a 404 Not Found error

D. They will see a blank page

Solution

1. Step 1: Understand the 'auth' middleware

   The 'auth' middleware restricts access to authenticated users only.

2. Step 2: Behavior for guests

   If a guest tries to access a route with 'auth' middleware, Laravel redirects them to the login page.

3. Final Answer:

   They will be redirected to the login page -> Option B

4. Quick Check:

   Auth middleware redirects guests [OK]

Hint: Auth middleware redirects guests to login [OK]

Common Mistakes:

• Assuming guests see the dashboard
• Expecting 404 error instead of redirect
• Thinking middleware shows blank page

4. This Laravel controller method is intended to validate user input securely:

public function store(Request $request) {
    $data = $request->validate([
        'email' => 'required|email',
        'password' => 'required|min:8'
    ]);
    User::create($data);
}

What is the main security issue here?

medium

A. Passwords are not hashed before saving

B. Email validation rule is incorrect

C. Validation rules are missing CSRF token check

D. User::create() should be User::update()

Solution

1. Step 1: Check validation rules

   The validation correctly checks email and password format.

2. Step 2: Check password handling

   The password is saved directly without hashing, which is insecure.

3. Final Answer:

   Passwords are not hashed before saving -> Option A

4. Quick Check:

   Passwords must be hashed before saving [OK]

Hint: Always hash passwords before saving to database [OK]

Common Mistakes:

• Assuming validation hashes passwords
• Confusing CSRF with validation rules
• Thinking create() vs update() affects security here

5. You want to protect an API route in Laravel so only authenticated users with the role 'admin' can access it. Which is the best approach?

hard

A. Use 'auth' middleware and check role inside the controller method

B. Use 'guest' middleware and check role in middleware

C. No middleware needed; check role in the route definition

D. Use 'auth' middleware and create a custom middleware to check 'admin' role

Solution

1. Step 1: Understand middleware roles

   'auth' middleware ensures user is logged in; role checks require custom logic.

2. Step 2: Best practice for role checks

   Create a custom middleware to check if the authenticated user has 'admin' role, then apply both middlewares.

3. Final Answer:

   Use 'auth' middleware and create a custom middleware to check 'admin' role -> Option D

4. Quick Check:

   Combine auth + custom role middleware [OK]

Hint: Combine auth middleware with custom role middleware [OK]

Common Mistakes:

• Using 'guest' middleware for authenticated routes
• Checking roles only inside controller
• Skipping middleware for role checks