Laravel security best practices — authentication, authorization, Eloquent safety, CSRF, XSS prevention, API security, and secure deployment configurations. Use when reviewing Laravel auth, Eloquent safety, CSRF, XSS, API security, or deployment configuration.

Laravel Security Best Practices Comprehensive security guidelines for Laravel applications to protect against common vulnerabilities. When to Activate Setting up Laravel authentication and authorization (Sanctum, Passport, Jetstream, Breeze) Implementing user roles, permissions, and policies Configuring production security settings and environment variables Reviewing Laravel applications for security vulnerabilities Deploying Laravel applications to production Writing secure Eloquent queries and migrations Production Configuration Essential Production Settings Environment File Security HTTPS Enforcement Authentication Sanctum (API Token Authentication) Password Security Session Management Authorization Gates Policies Middleware Authorization Eloquent Security Mass Assignment Protection SQL Injection Prevention Attribute Casting Model Security CSRF Protection Default Protection Excluding Routes (Carefully) CSRF with JavaScript XSS Prevention Blade Templating Security Safe HTML Handling JavaScript Context Escaping HTTP Headers for XSS Protection Input Validation Form Request Validation Custom Validation Rules API Security Rate Limiting API Authentication — Sanctum vs Passport CORS Configuration File Upload Security Validation Secure Storage Dependencies and Secrets Composer Security Secret Management Queue Security Logging Security Events Quick Security Checklist Check Description APP DEBUG=false Never run with debug enabled in production APP KEY set Always run php artisan key:generate HTTPS enforced Force HTTPS in production via middleware or proxy $fillable whitelisted Never use $guarded = [] CSRF active @csrf on all state changing forms Sanctum/Passport configured API authentication with token abilities/scopes Rate limiting applied Throttle API and auth endpoints Input validation FormRequest with specific rules, never $request all() File upload restrictions Validate MIME types, size, dimensions composer audit in CI Check dependencies for known vulnerabilities password hash / password verify Use Laravel's built in hashing (bcrypt/Argon2) Session regeneration on login Call $request session() regenerate() Security headers middleware CSP, X Frame Options, X Content Type Options Logged security events Audit log for auth failures, role changes, suspicious activity .env not committed Verify .gitignore includes .env Related Skills laravel patterns — Laravel architecture, routing, Eloquent, and API patterns backend patterns — General backend API and database patterns laravel tdd — Laravel testing with PHPUnit and Pest

laravel-security