Blog Entries Tagged "security" on Milwaukee Web Developer, PHP and Laravel Programmer, Consultant

Why Do I Use Plain Text Password for My Initial User Record?

Wed, 27 May 2026 00:00:00 +0000

When I create a project, I will have at least one user seeded into the database. This usually is an admin user as well.

So, why would I create this user with a plain text password initially?! That’s crazy right?

Let me explain why - and then you can see if you agree.

Validate Everything Including Pagination

Tue, 26 May 2026 00:00:00 +0000

There are many reasons why we validate data - whether it’s a Laravel project or any other framework or technology. Sometimes it’s for user or business sanity, other times to keep the application functioning properly. We even do so for security - for both security attacks we know about and hopefully to stop ones we don’t understand.

This is the reason why I reached for validation on pagination requests. This is user input. Just because I don’t understand how it could hurt me doesn’t mean I should ignore it, right?

Let’s validate pagination - easily - in Laravel.

Stopping Laravel SQL Injection with sole()

Fri, 07 Nov 2025 00:00:00 +0000

I love using Eloquent’s sole() method in Laravel. It throws an exception if the result set is ever more than 1. It means you should only have a sole record. This is usually what I want. I’ve migrated away from firstOrFail() unless I legitimately want the first of a matching set.

But I just found another reason to love using the sole method - it helps add a layer of protection against SQL injection. Let’s find out how.

Laravel Log Throttled Users

Sun, 01 Sep 2024 10:10:43 -0500

You’ve got Laravel throttling set up on authentication, password reset and other sensitive endpoints. But, how do you know this is actually working to stop people? Or what if you either want to admonish bad users or proactively reach out with support to help them? Perhaps you might want to log your throttled attempts. It’s pretty easy.

Laravel Password Reset a Little Better

Wed, 27 Mar 2024 12:02:33 -0500

There are a number of tools and packages that help you manage your users and their associated password reset flows available. The Laravel docs also describe a way that you can reset your password in your own controller. Depending on the use case of the application, I end up having to use code like this in some applications when other packages won’t work as drop-ins. But, can we make this example a little better, more secure, easier to read or a better UX? I think so. Let’s go.

Use Github Actions Permissions with 3rd Party Actions

Wed, 06 Dec 2023 08:58:51 -0600

I can’t say how much I love Github actions. It really felt like a game-changer for me. But I always had some concerns about security. How do we stop 3rd party actions from accessing stealing our code?

Why Care About Privacy with Web Analytics?

Sat, 24 Dec 2022 00:00:00 +0000

If Google gives free access to their web traffic tool called Google Analytics, why would you need anything else? Why would you care? Let’s briefly talk about why privacy matters and what you can do instead.

Securing Laravel from Hackers

Mon, 23 Aug 2021 00:00:00 +0000

Laravel Hacker is no longer a brand. You can find my security work at MasteringLaravel.io/security

Laravel is a great framework that is pretty secure by default. However, configuration mistakes or coding errors can still leave your app open for attack. Where do you go for help?

Illustrating Why Fillable and Validated Matter in Laravel

Mon, 22 Feb 2021 00:00:00 +0000

When given a choice of methods and ways to do something, it might not be clear which way is the best. As programmers, we tend to pick the easiest, then. However, the easiest can have security implications. Let me illustrate why we should use more stringent controls in a Laravel project.

Remember to Review Your Package Code for Security

Mon, 12 Aug 2019 00:00:00 +0000

Open source software is wonderful for many reasons. One of the best is we can see and inspect the software for vulnerabilities. But, far too many people actually do this. Let me demonstrate, using a Laravel package, how this lack of review might backfire and cause you grief.