Laravel Security
Laravel Security Checker
Comprehensive security analysis for Laravel applications
Tentang Laravel Security CheckerAbout Laravel Security Checker
What Is a Laravel Security Checker?
A Laravel Security Checker is an automated scanning tool that analyzes Laravel applications for common security vulnerabilities, misconfigurations, and potential attack vectors. Laravel is one of the most popular PHP frameworks, powering millions of web applications worldwide. While Laravel provides excellent built-in security features, misconfigurations and oversights can still leave applications vulnerable. Our free online scanner performs 13 comprehensive security checks to help you identify and fix vulnerabilities before they can be exploited.
The Laravel Security Checker at Jayax.dev examines your application for exposed environment files, debug mode settings, accessible storage paths, CSRF protection gaps, vendor directory exposure, missing security headers, cookie security issues, and much more. Each check produces a detailed finding with severity rating, evidence, and actionable remediation steps to help you harden your Laravel installation.
Common Laravel Vulnerabilities
Laravel applications face a wide range of security threats. Understanding these vulnerabilities is the first step toward protecting your application and your users.
- Exposed .env file — The environment configuration file contains database credentials, application keys, API secrets, and other sensitive information. If accessible via the web, attackers can read your entire configuration and potentially take full control of your application and database.
- APP_DEBUG enabled in production — When debug mode is active, Laravel displays detailed error pages with stack traces, environment variables, and internal application structure. This gives attackers valuable reconnaissance information about your application.
- Exposed storage/logs path — Laravel stores application logs in storage/logs/laravel. If accessible, these logs can reveal error details, stack traces, and sensitive debugging information about your application.
- Missing CSRF protection — Cross-Site Request Forgery protection is a critical security feature in Laravel. Without it, attackers can trick authenticated users into performing unwanted actions on your application.
- Exposed vendor directory — The vendor directory contains all Composer dependencies. If publicly accessible, attackers can identify exact package versions and target known vulnerabilities in your dependencies.
- Missing security headers — Without proper HTTP security headers, browsers cannot apply built-in protections against clickjacking, XSS, MIME-type sniffing, and protocol downgrade attacks.
- Insecure cookie attributes — Session cookies without Secure, HttpOnly, and SameSite flags are vulnerable to theft via XSS attacks or man-in-the-middle interception.
How the Security Scanner Works
Our Laravel Security Scanner performs a systematic series of non-invasive checks against your target URL. Each check is designed to identify a specific vulnerability or misconfiguration without causing any harm to your application. The scanner operates entirely in the browser, sending standard HTTP requests similar to what a normal visitor would generate.
The 13 Security Checks
- APP_DEBUG exposure — Checks if debug mode is visible in error responses, which would reveal sensitive application details
- .env file accessibility — Attempts to access the environment configuration file that contains database credentials and API keys
- Exposed storage/logs path — Verifies whether the Laravel log file is publicly accessible at /storage/logs/laravel
- Register route detection — Checks if registration routes are active and properly protected with CSRF tokens
- CSRF protection verification — Examines forms for the presence of CSRF token fields
- Exposed vendor directory — Tests whether the Composer vendor directory is accessible via directory listing
- Mix/Manifest file exposure — Checks for publicly accessible build manifest files that reveal asset paths
- phpinfo disclosure — Tests for publicly accessible PHP configuration pages
- Sensitive cookie attributes — Verifies that session cookies have Secure, HttpOnly, and SameSite flags
- Middleware coverage analysis — Checks common routes for expected middleware headers
- API rate limiting presence — Checks for rate limit headers (X-RateLimit-*) on API endpoints
- CORS configuration — Tests for dangerous Cross-Origin Resource Sharing policies
- Security headers compliance — Checks for X-Frame-Options, X-Content-Type-Options, CSP, HSTS, Referrer-Policy, and Permissions-Policy headers
Understanding Your Security Score
After completing all 13 checks, the scanner calculates an overall security score from 0 to 100. The scoring system weights findings by severity: Critical issues deduct 15 points, High issues deduct 10 points, Medium issues deduct 5 points, and Low issues deduct 2 points. Informational findings do not affect the score. The final score is mapped to a letter grade from A+ (97-100) to F (0-59).
A score of 90 or above indicates a well-hardened Laravel application with minimal exposure. Scores between 70 and 89 suggest moderate security with some areas needing attention. Below 70 indicates significant vulnerabilities that should be addressed promptly. A failing grade (below 60) means your application has critical security issues that require immediate action.
Laravel Security Best Practices
Beyond fixing the issues identified by our scanner, following these Laravel security best practices will significantly improve your application's security posture.
- Keep APP_DEBUG false in production — Always set APP_DEBUG=false in your production .env file. Use error reporting services like Sentry or Bugsnag to monitor errors without exposing details to users.
- Protect your .env file — Ensure your web server document root points to the public/ directory. Add server-level rules to block access to .env files. Never commit .env files to version control.
- Use Laravel's built-in security features — Leverage CSRF protection, encrypted cookies, password hashing (bcrypt/argon2), and input validation. These features are enabled by default and provide strong baseline security.
- Implement proper authentication — Use Laravel Fortify or Jetstream for robust authentication. Enable two-factor authentication, email verification, and password confirmation for sensitive actions.
- Configure rate limiting — Apply the throttle middleware to API routes and login endpoints. Use the RateLimiter facade to define custom rate limits that match your application's usage patterns.
- Keep dependencies updated — Regularly run composer update and audit your dependencies for known vulnerabilities. Use tools like composer audit and Roave Security Advisories to stay informed about security patches.
- Use HTTPS everywhere — Install an SSL/TLS certificate and enforce HTTPS for all connections. Set APP_URL to use HTTPS and enable the Secure flag on session cookies.
- Implement proper CORS policies — Configure CORS in config/cors.php to only allow trusted origins. Never use wildcard origins with credentials enabled.
- Add security headers — Create a middleware to add security headers like X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, and Strict-Transport-Security to all responses.
- Validate and sanitize input — Always use Laravel's validation rules for user input. Use type-hinted form requests for complex validation. Never trust user input without validation.
- Use parameterized queries — Laravel's Eloquent ORM and query builder use parameterized queries by default, protecting against SQL injection. Avoid raw query strings with user input.
- Regular security audits — Periodically review your application for security issues. Use automated tools, code reviews, and penetration testing to identify vulnerabilities before attackers do.
AI-Powered Remediation
Our Laravel Security Checker goes beyond simple vulnerability detection. Each finding includes an AI-powered remediation feature that provides personalized, detailed fix instructions. Click the "Get AI Fix" button on any individual finding, or use the overall "AI Analysis" button to receive a comprehensive, prioritized action plan for all identified vulnerabilities. The AI considers your specific configuration and provides code examples, configuration changes, and step-by-step instructions tailored to your findings.
When to Scan Your Laravel Application
Regular security scanning should be part of your Laravel maintenance routine. We recommend scanning your application in these situations:
- After deployments — Scan whenever you deploy new code to verify that security configurations remain intact and no new vulnerabilities have been introduced
- After server migrations — Moving to a new server or hosting provider can change security settings; always scan after migration
- Monthly routine — Run a scan at least once a month as part of your regular maintenance schedule
- After dependency updates — Scan after running composer update to check if new packages introduce security issues
- Suspected compromise — If you notice unusual behavior, scan immediately to identify potential entry points
- Before launch — Always scan new Laravel applications before making them publicly accessible
By regularly using the Laravel Security Checker at Jayax.dev, you can maintain a strong security posture and protect your application, your users, and your data from common Laravel attacks. Start scanning today to identify and fix vulnerabilities before they can be exploited.
Pertanyaan yang Sering DiajukanFrequently Asked Questions
A Laravel Security Checker is an online tool that scans Laravel applications for common security vulnerabilities and misconfigurations. It checks for exposed environment files, debug mode settings, accessible storage paths, CSRF protection, vendor directory exposure, missing security headers, and other issues that attackers could exploit. The tool provides a security score and detailed remediation steps for each finding.
The scanner sends HTTP requests to common Laravel endpoints and analyzes the responses. It checks for APP_DEBUG exposure, .env file accessibility, exposed storage/logs paths, active registration routes, CSRF protection, vendor directory listing, Mix/Manifest file exposure, phpinfo disclosure, cookie security attributes, middleware coverage, API rate limiting, CORS configuration, and security headers compliance. Each check returns a severity rating and remediation advice.
Yes, the security scan is completely safe. It only performs read-only checks by sending standard HTTP requests that any browser would make. It does not attempt to exploit vulnerabilities, modify files, or perform any destructive actions. The scan is equivalent to manually checking these URLs in your browser.
The security score ranges from 0 to 100, starting at 100 and deducting points based on findings: Critical issues deduct 15 points, High issues deduct 10, Medium issues deduct 5, and Low issues deduct 2. The score is converted to a letter grade from A+ (97-100) to F (0-59). A higher score indicates better security posture.
When APP_DEBUG is set to true in production, Laravel displays detailed error pages with stack traces, environment variables, database credentials, and internal application structure. This gives attackers valuable information about your application architecture, dependencies, and potential entry points. Always set APP_DEBUG=false in production environments.
The .env file contains your most sensitive configuration including database credentials (DB_HOST, DB_USERNAME, DB_PASSWORD), application keys (APP_KEY), API keys for third-party services, mail server credentials, and more. If exposed, attackers can use this information to access your database, decrypt sessions, impersonate your application, and potentially take full control of your server.
Ensure your web server document root points to the public/ directory, not the project root. The storage directory should never be publicly accessible. For Apache, add rules to deny access: RedirectMatch 403 /storage/.*. For Nginx, add: location ~ ^/storage/ { deny all; }. Also ensure the storage link (storage/app/public) is properly configured and only exposes intended files.
Security headers are HTTP response headers that instruct browsers to enable built-in security protections. Important headers include X-Frame-Options (prevents clickjacking), X-Content-Type-Options (prevents MIME sniffing), Content-Security-Policy (prevents XSS), Strict-Transport-Security (enforces HTTPS), Referrer-Policy (controls referrer information), and Permissions-Policy (controls browser features). You can add these via Laravel middleware.
If your application does not need public user registration, disable it by modifying your auth routes. When using Laravel Breeze or Jetstream, update Auth::routes() to Auth::routes(['register' => false]). For Fortify, set Features::registration() to false in config/fortify.php. This prevents attackers from creating unauthorized accounts.
Cross-Origin Resource Sharing (CORS) misconfiguration occurs when your Laravel API allows requests from any origin (wildcard *) or reflects the requesting origin. This can enable cross-site attacks where malicious websites interact with your API on behalf of authenticated users. Configure CORS in config/cors.php to only allow trusted, specific origins.
Laravel provides built-in rate limiting through the throttle middleware. Configure it in app/Http/Kernel.php or directly on routes. Use the RateLimiter facade to define custom rate limits: RateLimiter::for('api', function (Request $request) { return Limit::perMinute(60); }); Apply the middleware to your API routes: Route::middleware(['throttle:api'])->group(...).
You should scan your Laravel application at least monthly, after any major changes (dependency updates, new packages, server migrations), and immediately if you suspect a security breach. Regular scanning helps catch new vulnerabilities before attackers can exploit them. Consider integrating automated security checks into your CI/CD pipeline.
Start by addressing Critical and High severity findings first. Common fixes include setting APP_DEBUG=false, blocking .env file access, protecting the storage and vendor directories, enabling CSRF protection, adding security headers via middleware, configuring proper CORS policies, implementing rate limiting, and ensuring cookies have Secure, HttpOnly, and SameSite attributes. Use Laravel's built-in security features and consider packages like laravel/fortify for authentication hardening.