OWASP Top 10

Vulnerablepublic function show(int $id): Response
{
    // No check: any logged-in user can see any order!
    $order = Order::findOrFail($id);
    return response()->json($order);
}

Securepublic function show(int $id): Response
{
    $order = Order::findOrFail($id);

    // Verify caller owns this resource
    if ($order->user_id !== auth()->id()) {
        abort(403);
    }

    return response()->json($order);
}

Vulnerable// Storing passwords with MD5
$hash = md5($password);  // ⚠ broken

// Logging sensitive data
Log::info('Login: ' . $email . ' ' . $password);

// Transmitting over HTTP (no TLS)
'APP_URL=http://myapp.com'

Secure// Use bcrypt / Argon2 (Laravel default)
$hash = Hash::make($password); // ✓

// Never log credentials or tokens
Log::info('Login attempt: ' . $email);

// Enforce HTTPS everywhere
'APP_URL=https://myapp.com'
URL::forceScheme('https');

Vulnerable — SQL Injection$query = "SELECT * FROM users WHERE email = '"
       . $request->email . "'";   // ⚠
DB::select($query);

// Input: ' OR '1'='1
// Query becomes: WHERE email='' OR '1'='1'
// → returns ALL users

Secure — Parameterized Query// Use Eloquent (parameterized by default)
User::where('email', $request->email)->first();

// Or raw with binding
DB::select(
    'SELECT * FROM users WHERE email = ?',
    [$request->email]   // ✓ safely bound
);

Vulnerable — production .envAPP_ENV=local      // ⚠ wrong
APP_DEBUG=true    // ⚠ exposes stack traces
DB_PASSWORD=     // ⚠ empty password
TELESCOPE_ENABLED=true  // ⚠ debug UI public

// XML external entity processing enabled
libxml_disable_entity_loader(false);

Secure — production .envAPP_ENV=production
APP_DEBUG=false
DB_PASSWORD=<strong-secret>
TELESCOPE_ENABLED=false

// Restrict CORS to known origins
'allowed_origins' => ['https://myapp.com'],

// Set security headers
'X-Frame-Options': DENY

Risk// Never checking for vulnerabilities
$ composer update --no-scripts   // blindly update

// Using abandoned packages
"league/oauth2-server": "^4.0"   // 2018, EOL

// No lock file committed (unpredictable deps)
.gitignore: composer.lock        // ⚠

Secure// Audit regularly
$ composer audit

// Pin versions in production
$ composer install --no-dev      // use lock file ✓

// Monitor CVEs with Dependabot / Renovate

// Subscribe to security advisories
// github.com/FriendsOfPHP/security-advisories

Vulnerablepublic function login(Request $request): Response
{
    // No rate limiting — allows brute-force
    $user = User::where('email', $request->email)
                ->first();

    if (Hash::check($request->password, $user->password)) {
        Auth::login($user);
        return redirect('/');
    }
}

Secureuse Illuminate\Routing\Middleware\ThrottleRequests;

Route::post('/login', [AuthController::class, 'login'])
     ->middleware('throttle:5,1');  // 5/min ✓

// session.php — secure session config
'secure'    => true,   // HTTPS only
'http_only' => true,   // no JS access
'same_site' => 'strict', // CSRF protection

Vulnerable// Deserializing untrusted user input
$data = unserialize($request->data);  // ⚠

// Loading script with no integrity check<script src="https://cdn.example.com/lib.js">
</script>   // ⚠ supply chain risk

// Auto-deploying from any pull request
// (no review, no signing)

Secure// Use JSON, not serialize
$data = json_decode($request->data, true);  // ✓

// Subresource Integrity (SRI) for CDN scripts<script
  src="https://cdn.example.com/lib.js"
  integrity="sha384-abc123..."
  crossorigin="anonymous"></script>

// Require signed commits in CI/CD

Vulnerablepublic function login(Request $request): Response
{
    if (Auth::attempt($request->only('email', 'password'))) {
        return redirect('/');
        // No log of successful login
    }
    return back()->withErrors([...]);
    // No log of failed attempt either
}

Secureif (Auth::attempt($credentials)) {
    Log::channel('security')->info('Login success', [
        'user' => $request->email,
        'ip'   => $request->ip(),
        'ua'   => $request->userAgent(),
    ]);
} else {
    Log::channel('security')->warning('Login failed', [
        'email' => $request->email,
        'ip'    => $request->ip(),
    ]);
}