This is the thirteenth security tip from Laravel Security in Depth.Subscribe to receive weekly security tips and monthly In Depth emails covering Laravel Security topics. Passwords are the digital keys that keep user accounts safe, but passwords only work when they are secret and unguessable. The classic “fix” is to impose password complexity rules, but […]
Category: Development
This is the tenth security tip from Laravel Security in Depth.Subscribe to receive weekly security tips and monthly In Depth emails covering Laravel Security topics. When committing changes into version control, you should always selectively stage your changes first before committing. This allows you to manually review every line of code you commit, to ensure […]
This is the seventh security tip from Laravel Security in Depth, which was sent out on November 9th. You can subscribe to receive more tips and monthly In Depth emails covering of Laravel Security. Don’t trust user input. Don’t trust user input. And one more for good measure… Don’t trust user input. You should always […]
This is the fourth security tip from my Laravel Security in Depth newsletter, sent out to all subscribers on October 8th. Please subscribe if you’d like these tips delivered weekly. Laravel provides an expressive fluent interface for building database queries, either as raw queries through the query builder or as part of Eloquent (Laravel’s Object-Relational Mapper, ORM). The query builder allows […]
This is the first security tip from my Laravel Security in Depth newsletter, sent out on Monday to all subscribers. Please sign up if you’d like these tips delivered weekly. Laravel allows you to cast model attributes as encrypted strings, when stored in the database. This gives you added security for any values that are […]
I love debugging weird bugs. There is something fun about tracking down a weird bug, spending time replicating the circumstances, and eventually tracing the issue to the cause of the bug. Once you’ve found the cause, the fix is often incredibly trivial – something that was overlooked or not considered when the code was originally […]
In the original version my talk “Think Like a Hacker and Secure WordPress, live on stage“, I demonstrated a Cross-Site Request Forgery (CSRF) attack. While this attack worked perfectly during WordCamp Brisbane 2019, in-progress changes to Google Chrome (version 80) are bringing about the end of CSRF. (Well, sort of…) In light of this change, […]
A relatively unknown and underused feature of Git is the ability to cryptographically sign commits. It is an optional feature that provides a way for the author of a commit to prove ownership. It uses the author’s GPG key to leave a signature in the commit that can be checked later. If you’re a Keybase […]
Note: I originally wrote and published this article as a Semaphore CI Community Tutorial. Introduction PHPUnit is one of the oldest and most well known unit testing packages for PHP. It is primarily designed for unit testing, which means testing your code in the smallest components possible, but it is also incredibly flexible and can […]
I am lucky enough to get to work on a large Laravel 5 full time in my day job, with some awesome developers.I recently came up with what is, in my humble opinion, an elegant and simple solution for what we all initiallythought was quite a complex problem. If you’ve used this trick before,or know […]