As someone that’s been using Laravel since v4.2, I love your content , straight to the point, no dithering , no BS - I hope you get your silver platter soon :)
Pov, this is good stuff. Can I suggest you do more videos with the theme of "common mistakes". Security is the obvious topic but there are many others where developers do things that while they do not expose security issues nevertheless create problems for the user experience and app stability. This is a serious thing and would increase views to your channel. Thanks for your hard work and I hope you hit 100K subs soon.
Thanks for the idea. I am actually doing more videos like this, just maybe never calling it specifically "common mistakes". Maybe need to make rebranding of the titles :)
When using livewire: if you have a model or collection of models defined as public class variable, their attributes are sent to the client and visible with a simple view source as are all the public variables.
Best wishes for getting that silver button soon! You deserve it. I can’t imagine putting out a video *daily*, and such quality content, and well-delivered, too. Your “hello guys” at the beginning is so friendly & familiar - love it. :)
I had the ugly experience of patch a php application that had the 5.x version, no framework and legacy code. it had no validation, no token, no escape variables and most important 0 documentation. It was a nightmare to patch up and migrate to php 8. Everything while the APP was under heavy attack from bad guys
If you can't "Imagine what could go wrong if any person could inject any javascript on your page.", think of a javascript initiated POST request changing data on the server using your credentials as it is you that sees the page in your browser.
I also want to tell my story. When I first started learning things like TypeScript, I didn’t quite understand how I could make a POST request to the server and pass the CSRF token from the TS file. For this reason, I (I still don’t understand why) made these requests through the api.php file. A little later I found out that requests that are processed in api.php are not protected against csrf attacks. This mechanism works in web.php, while api requests do not require any tokens to run controller methods. To be honest, I still don’t quite understand how I can correctly make such requests if they come from a .ts file. If anyone knows more about this, could you tell me what solutions there are?
I have to clean up one project before. Using CORS * on production, doesn't turn off app debug, render directly the db column name to table instead of using alias, only validation on the client size. It took me only 10 seconds to figure it out how to break into the database.
is Java secured? I am going to leave a general answer "If the developer is bad at coding and doesn't care about securing their application NO", but then again there is a job market for people that are paid to look at the code and yell at those developers that they should not hardcode security keys inside the client app (for example: 2 years ago I was listening to a podcast of a lady that said she found hardcoded security keys inside android banking applications, with comments in the code "stop putting security keys in the code") So to sum it up, most of the time the problem is between the chair and the screen
pls I am used to csrf but with the invention of livewire, is it necessary again because I dint even bother to include it because you can submit form without even form elements using livewire.
Hi Sir please make one video on how to prevent unauthorized user to access of our code directly mainly from server side. For Example. How to secure server for Laravel projects as well as what are the loopholes how to prevent them etc.
Thanks. very informative, while watching I thought of .. what if there's a video version (course?) of the Laravel documentation, that's too much though 😅
There is a case that isn't handled by laravel blade: the href property of the "a" tag. the href value could be equal to something like javascript:alert(1). If the href value comes from users you don't trust you have to make sure it doesn't start with "javascript:" or you could make sure it has a valid URL format
Last week analyzing my apache log I found some requests to /.env, so make sure that your .env file is not public, you never will be 100% safe, so do your best
Thank you for this great stuff. I'll more thankful if you also create video of how to overcome this issues specially file access or .env access from shared hosting or public folders.
First of all, big thanks, what about xml attack? And sql injections? Have any vulnerability for sql injections in laravel? If yes, how can it be safer?
Well done Povi ! May I ask if you can do a video on how to approach a php/laravel upgrade task. So for example, upgrading from laravel 8 to 9, and what steps you would take.
About what you said at 11:15 ("do not use get requests for anything that should be changing the data" ) : we can use a middleware (like "authenticate" or any custom middleware to authorise the get route call.
Hello! Maybe you recording video on laravel Policy? How block any action in another user when user is not the same Group. Or how user can get only our post when he post another id in request. I have problem with this and no were information how do this. I have two model Clients and Users, Clientis Group amd have more users. Now when i send GET REQUEST id another client i can get users another client.
Hello Povilas, Great video! Just 1 question regarding the first example. What about the cases I have a WYSIWYG in my blog post and the user can enter a html? I am forced to escape it. what's the solution?
thank you. please make this video more advanced. maybe for example, case someome is attacking you by register 2 user every minutes with valid otp (this crazy but it reals dont know how they have random phone number otp), then you block its IP but he changes his IP and last you use recaptcha to prevent the attack.
Good stuff. Would you ever consider doing a course on security in Laravel, PHP, and Livewire, or even just more videos on it? It's a huge concern that I feel like doesn't get enough attention, and even as a mid-level developer and working with Laravel over 5 years, I'm not always sure how to be sure my code is 100% secure other than avoiding some of the obvious like you point out in this video. Like a good example of content you could cover is how supposedly we should be using UUIDs for our models, but it's not always clear the best way to do that or when to do that
Well, I've covered the main things in this video, so not sure what I would say in a course. For UUIDs, I have that covered in other courses, like here: laraveldaily.teachable.com/courses/how-to-structure-database-in-laravel/lectures/31520548
@@LaravelDaily I didn't know all those json queries, so not using that. Putting id's in json should slow thing down, wouldn't do that. My question is more about decoding json in api calls, and the associated security problems.
Is it a mistake to add data in a migration, or should migrations only change the database structure? For example, we keep our translations in a database table. If we need another word translated, should we add this in a migration? Or should we use a seeder? Or something else?
Every database structure and data that makes the application usable from the start should go in migrations. Seeders are for testing or even demo purposes.
Hello, Povilas I have a question. Lets say there is a blog post site and user can make a post that contains all those html tags like link, table and so on, how the content should be displayed if {!! $content !!} is a security issue? Should developer write a some code that checks if there are strings like or
I think in this situation, always wrap the content with PHP htmlspecialchars() function before saving it to the database. By doing so it will convert all the tags to special characters. Now when showing, you can use the {!! $content !!} and you will be fine. Even if a user pass a malicious script, it will not execute
I won't recommend it too. You have to change the root folder directory and change the app boot directory. I don't like the hack. it's not easily maintainable
Thank you so much for your video. Please make a video on passing {id} value in route. We are using direct id which is the primary key for the Post, Put method and Laravel also use the same in resource controller. Please make a video with this topic and security issues.
How to upload a image via mobile camera in website from mobile browser using laravel livewire ? I have tried by adding attribute capture in file input and opened a site in mobile browser and trying to upload it shows file manager and camera option i selected the camera and taken the image and upload livewire showing failed to upload image
@@yasark6347 I don't think Livewire is different from Laravel, it's the back-end framework, the question is what tools you use on the front-end for the upload - a simple input or something more complex. Again, hard to answer in a comment. But yes, it's possible, mobile browser is still a browser.
We disable @csrf on sale forms. Customer might leave browser open for the whole day and only then can submit the form. I know, that there is some javascript packages, which updates csrf codes, but that doesn't gurantee in 100% and we do not want to lose a sale. (not perfect from security side, but sales are more important)
