Security best practices in Laravel - Step-by-Step Execution

Concept Flow - Security best practices

User Input Received

↓

Validate Input

↓

Sanitize Input

↓

Check Authentication

↓

Check Authorization

↓

Process Request

↓

Escape Output

↓

Send Response

This flow shows how Laravel handles security by validating, sanitizing, authenticating, authorizing, and escaping data before responding.

Execution Sample

Laravel

<?php
$request->validate(['email' => 'required|email']);
$user = User::where('email', $request->email)->first();
if ($user && Hash::check($request->password, $user->password)) {
    Auth::login($user);
}

This code validates user input, checks credentials, and logs in the user securely.

Execution Table

Step	Action	Input/State	Result/Output
1	Validate input	email = '[e-mail]'	Passes validation
2	Query user by email	email = '[e-mail]'	User found or null
3	Check password hash	input password, stored hash	True if match, else false
4	Authenticate user	password check true	User logged in
5	Send response	User logged in	Redirect to dashboard
6	Exit	N/A	Process complete

💡 Process stops after sending response to user

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
email	null	'[e-mail]'	'[e-mail]'	'[e-mail]'	'[e-mail]'	'[e-mail]'
user	null	null	User object or null	User object or null	User object or null	User object or null
password_check	null	null	null	true or false	true or false	true or false
authenticated	false	false	false	false	true if password_check true	true or false

Key Moments - 3 Insights

Why do we validate input before querying the database?

Validating input first (see Step 1 in execution_table) prevents bad or malicious data from reaching the database, protecting against injection attacks.

What happens if the password check fails?

If password_check is false (Step 3), authentication does not proceed (Step 4), so the user is not logged in, preventing unauthorized access.

Why do we escape output before sending the response?

Escaping output prevents malicious scripts from running in the browser, protecting against cross-site scripting (XSS) attacks.

Visual Quiz - 3 Questions

Look at the execution_table, what is the result of Step 2 if the email is not found?

A User object is returned

B Null is returned

C An error is thrown

D Password is checked anyway

💡 Hint

Check Step 2 'Result/Output' column in execution_table

At which step does the system confirm the user's password is correct?

A Step 3

B Step 1

C Step 2

D Step 4

💡 Hint

Look at the 'Action' column in execution_table for password verification

If input validation fails, what would change in the execution_table?

A Authentication would succeed anyway

B Step 2 would still query the database

C Step 1 would fail and no further steps run

D Response would be sent without validation

💡 Hint

Refer to Step 1 'Result/Output' and process flow in concept_flow

Concept Snapshot

Laravel Security Best Practices:
- Validate all user inputs early
- Sanitize and escape data to prevent attacks
- Use built-in authentication and authorization
- Hash passwords securely
- Escape output to avoid XSS
- Always check permissions before actions

Full Transcript

This visual execution shows Laravel's security best practices. First, user input is validated to ensure it meets rules like required and email format. Then the system queries the database for the user by email. Next, it checks the password by comparing the input with the stored hashed password. If the password matches, the user is authenticated and logged in. Finally, the system escapes output before sending the response to protect against cross-site scripting. This flow helps prevent common security issues like injection, unauthorized access, and XSS.

Practice

1. Which Laravel feature helps protect your application from Cross-Site Request Forgery (CSRF) attacks?

easy

A. Storing passwords in plain text

B. Using raw SQL queries without bindings

C. CSRF tokens automatically added to forms

D. Disabling middleware in routes

Solution

1. Step 1: Understand CSRF attacks

   CSRF attacks trick users into submitting unwanted requests. Laravel uses tokens to prevent this.

2. Step 2: Identify Laravel's protection method

   Laravel automatically adds CSRF tokens to forms and verifies them on submission.

3. Final Answer:

   CSRF tokens automatically added to forms -> Option C

4. Quick Check:

   CSRF protection = CSRF tokens [OK]

Hint: CSRF protection means using tokens in forms [OK]

Common Mistakes:

• Thinking raw SQL protects against CSRF
• Disabling middleware removes security
• Storing passwords in plain text is unsafe

2. Which of the following is the correct way to hash a password before saving it in Laravel?

easy

A. $hashed = Hash::make($password);

B. $hashed = bcrypt($password);

C. $hashed = md5($password);

D. $hashed = base64_encode($password);

Solution

1. Step 1: Identify Laravel's recommended password hashing

   Laravel provides the Hash facade's make method for secure password hashing.

2. Step 2: Compare options

   $hashed = Hash::make($password); is the recommended and most flexible method. bcrypt() helper is valid but less flexible. md5 and base64_encode are insecure.

3. Final Answer:

   $hashed = Hash::make($password); -> Option A

4. Quick Check:

   Password hashing = Hash::make() [OK]

Hint: Use Hash::make() for password hashing in Laravel [OK]

Common Mistakes:

• Using insecure md5 or base64_encode
• Confusing Hash::make without import
• Saving passwords without hashing

3. Consider this Laravel route definition:

Route::middleware(['auth'])->group(function () {
    Route::get('/dashboard', function () {
        return 'Welcome to your dashboard';
    });
});

What will happen if a guest (not logged in) tries to access /dashboard?

medium

A. They will see the dashboard message

B. They will be redirected to the login page

C. They will get a 404 Not Found error

D. They will see a blank page

Solution

1. Step 1: Understand the 'auth' middleware

   The 'auth' middleware restricts access to authenticated users only.

2. Step 2: Behavior for guests

   If a guest tries to access a route with 'auth' middleware, Laravel redirects them to the login page.

3. Final Answer:

   They will be redirected to the login page -> Option B

4. Quick Check:

   Auth middleware redirects guests [OK]

Hint: Auth middleware redirects guests to login [OK]

Common Mistakes:

• Assuming guests see the dashboard
• Expecting 404 error instead of redirect
• Thinking middleware shows blank page

4. This Laravel controller method is intended to validate user input securely:

public function store(Request $request) {
    $data = $request->validate([
        'email' => 'required|email',
        'password' => 'required|min:8'
    ]);
    User::create($data);
}

What is the main security issue here?

medium

A. Passwords are not hashed before saving

B. Email validation rule is incorrect

C. Validation rules are missing CSRF token check

D. User::create() should be User::update()

Solution

1. Step 1: Check validation rules

   The validation correctly checks email and password format.

2. Step 2: Check password handling

   The password is saved directly without hashing, which is insecure.

3. Final Answer:

   Passwords are not hashed before saving -> Option A

4. Quick Check:

   Passwords must be hashed before saving [OK]

Hint: Always hash passwords before saving to database [OK]

Common Mistakes:

• Assuming validation hashes passwords
• Confusing CSRF with validation rules
• Thinking create() vs update() affects security here

5. You want to protect an API route in Laravel so only authenticated users with the role 'admin' can access it. Which is the best approach?

hard

A. Use 'auth' middleware and check role inside the controller method

B. Use 'guest' middleware and check role in middleware

C. No middleware needed; check role in the route definition

D. Use 'auth' middleware and create a custom middleware to check 'admin' role

Solution

1. Step 1: Understand middleware roles

   'auth' middleware ensures user is logged in; role checks require custom logic.

2. Step 2: Best practice for role checks

   Create a custom middleware to check if the authenticated user has 'admin' role, then apply both middlewares.

3. Final Answer:

   Use 'auth' middleware and create a custom middleware to check 'admin' role -> Option D

4. Quick Check:

   Combine auth + custom role middleware [OK]

Hint: Combine auth middleware with custom role middleware [OK]

Common Mistakes:

• Using 'guest' middleware for authenticated routes
• Checking roles only inside controller
• Skipping middleware for role checks