Laravel Security: Top 7 Mistakes Developers Make

I often see the question: "Is Laravel secure?", and in this video, let's take a look at what the framework offers, and how developers use or misuse the security features.

00:00 Intro
00:37 Blade XSS Attack
02:34 Protect Your .env File
04:34 Don't Use $request-all()
05:53 File Upload: Client Data
06:38 APP_DEBUG=true in Production
08:17 CSRF and Route::get()
09:54 Rate Limiting

Links mentioned in the video:

- - - - -
Support the channel by checking out our products:

[ward]

You sure deserve a YouTube play button. Your content seems to be coming out right when I need something specific like you release, ha

[GSTU]

As someone that’s been using Laravel since v4.2, I love your content, straight to the point, no dithering, no BS - I hope you get your silver platter soon :)

[exintrovert]

Subscribed. Get that play button! You deserve it.

Straightforward, clear, no fluff… I love your style.

[khakimovnodir]

I really appreciate your every single video. They are so helpful to me.

[hollyhayes]

Best wishes for getting that silver button soon! You deserve it. I can’t imagine putting out a video *daily*, and such quality content, and well-delivered, too. Your “hello guys” at the beginning is so friendly & familiar - love it. :)

[aphelioschenik]

never played a full tutorial video without x2 speed outside work. very good video i subed

[rosselliot]

Pov, this is good stuff. Can I suggest you do more videos with the theme of "common mistakes". Security is the obvious topic but there are many others where developers do things that while they do not expose security issues nevertheless create problems for the user experience and app stability. This is a serious thing and would increase views to your channel. Thanks for your hard work and I hope you hit 100K subs soon.

[SinghatehAlagie]

Surely you will reach there soon sir, we always behind you and we will keep supporting to reach your goals. Thank you for the valuable contents.

[x]

Great video as always, would love to see more of these!

[icantchosemyname]

I didn't know about rate limiting feature, thank you a lot. I've just shared your video

[paulfontaine]

When using livewire: if you have a model or collection of models defined as public class variable, their attributes are sent to the client and visible with a simple view source as are all the public variables.

[hassanfazeel]

This is sooo goood..awesome work!
this channel deserve a "varified tick".
thanks a lot.

[emekatimothyiloba]

Wow this is very insightful sir. Thanks for sharing

[lovietech]

all() is one of my bad. Thank you so much for this tips. I will correct myself

[sawcenmaamri]

About what you said at 11:15 ("do not use get requests for anything that should be changing the data" ) : we can use a middleware (like "authenticate" or any custom middleware to authorise the get route call.

[emekatimothyiloba]

YOU WIll surely go beyond 200K subscribers Sir, you are really doing a great job. Thanks and God bless

[hermawansafrin]

Thank you sir, i think your videos is very usefull. Thanks for your dedication.

[FindWebX]

Thanks a lot for sharing knowledge with us

[chiraghvyas]

Thank you for this great stuff. I'll more thankful if you also create video of how to overcome this issues specially file access or .env access from shared hosting or public folders.

[hanymax]

Thanks Sir you helping so much .... i really appreciate it <3