laravel-security

原文涵盖的主题

• Laravel Security Best Practices
• When to Activate
• Production Configuration
• Essential Production Settings
• Environment File Security
• HTTPS Enforcement
• Authentication
• Sanctum (API Token Authentication)

Comprehensive security guidelines for Laravel applications to protect against common vulnerabilities. Setting up Laravel authentication and authorization (Sanctum, Passport, Jetstream, Breeze) Implementing user roles, permissions, and policies Configuring production security settings and environment variables Reviewing Laravel applications for security vulnerabilities Deploying Laravel applications to production Writing secure Eloquent queries and migrations | Check | Description | |-------|-------------| | APPDEBUG=false | Never run with debug enabled in production | | APPKEY set | Always run php artisan key:generate | | HTTPS enforced | Force HTTPS in production via middleware or proxy | | $fillable whitelisted | Never use $guarded = [] | | CSRF active | @csrf on all state-changing forms | | Sanctum/Passport configured | API authentication with token abilities/scopes | | Rate limiting applied | Throttle API and auth endpoints | | Input validation | FormRequest with specific rules, never $request->all() | | File upload restrictions | Validate MIME types, size, dimensions | | composer audit in CI | Check dependencies for known vulnerabilities | | passwordhash / passwordverify | Use

这里只展示节选，请以完整原文和当前要求为准。