skills.rest
Femad-6
Femad-6COMMUNITY
Explore all skills by this author →
WebsiteGitHub

laravel-security

Implements Laravel security controls for authentication, validation, CSRF, uploads, and rate limiting.

Updated Mar 25, 2026
Search Tags:#security#authentication#rate limiting#validation#php#laravel#csrf
One-click install
npx skills add https://github.com/Femad-6/my-skills --skill laravel-security-femad-6
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: laravel-security
Source: https://github.com/Femad-6/my-skills/tree/main/.github/skills/laravel-security
Command: npx skills add https://github.com/Femad-6/my-skills --skill laravel-security-femad-6

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Laravel applications are exposed to common vulnerabilities like SQL injection, XSS, CSRF, mass assignment, and insecure file uploads when developers skip framework-level protections. This Skill provides concrete, code-level guidance to harden Laravel apps against these threats. ## Core Features & Use Cases - Authentication & Authorization: Configure Sanctum token auth, password hashing rules, policies, gates, and route-level can middleware. - Input & Upload Safety: Enforce Form Request validation, mass-assignment guards, MIME/size checks on uploads, and private disk storage. - Attack Surface Hardening: Apply CSRF protection, rate limiters for login flows, security headers (CSP, HSTS, X-Frame-Options), CORS restrictions, signed URLs, and encrypted casts. - Use Case: When building a new API endpoint that accepts invoice uploads, use this Skill to add a Form Request with file validation, authorize via a policy, store to a non-public disk, and throttle the route. ## Quick Start Review my Laravel controller and routes for security issues and add the missing validation, authorization, and rate limiting.

Frequently Asked Questions about laravel-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure Laravel API endpoints with authentication?▼

Use Laravel Sanctum or Passport for API token authentication and protect routes with the auth:sanctum middleware. Prefer short-lived tokens with refresh flows, and revoke tokens on logout or account compromise.

How to prevent mass assignment vulnerabilities in Laravel?▼

Define $fillable or $guarded on Eloquent models and never call Model::unguard(). Prefer DTOs or explicit attribute mapping so request payloads cannot set unintended fields.

How do I validate file uploads in Laravel securely?▼

Use a Form Request with rules for file size, MIME type, and extension, such as 'mimes:pdf' and 'max:5120'. Store uploads on a non-public disk and scan files for malware when required.

Does Laravel protect against CSRF attacks by default?▼

Yes, the VerifyCsrfToken middleware is enabled by default for web routes. Include @csrf in forms, and for SPA authentication with Sanctum configure stateful domains so XSRF tokens are sent correctly.

How do I add rate limiting to Laravel login routes?▼

Define a limiter with RateLimiter::for('login') combining per-IP and per-email limits, then apply the throttle middleware to auth routes. Use stricter limits for login, password reset, and OTP endpoints.

What security headers should a Laravel app send?▼

Add Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy via custom middleware. Configure trusted proxies so HTTPS detection and redirects work correctly.

Related Skills

Explore More Software Engineering Skills→
caovinhphuccaovinhphuc

laravel-security

Harden Laravel authentication, authorization, validation, CSRF, and deployment settings.

Community
Advanced
elmochilyaselmochilyas
8

laravel-security

Audit Laravel 13 applications for security vulnerabilities and enforce best practices.

Community
Advanced
Sake-TeamSake-Team

laravel-security

Enforce security best practices in Laravel applications with middleware, guards, and validation.

Official
Advanced
truongnattruongnat

django-pro

Develops Django applications with ORM, REST Framework integration, middleware, and signals.

Community
Advanced