Questions tagged [laravel]

Laravel is a PHP framework.

Filter by
Sorted by
Tagged with
0 votes
0 answers

Why are Laravel's refresh tokens so big?

Laravel Passport implements OAuth2 flows and does the usual thing of issuing access tokens in JWT format, and an opaque random string as the refresh token. These refresh tokens are enormous - around ...
Synchro's user avatar
  • 717
2 votes
0 answers

Automated bot/spammer bypassing google recaptcha v2

I have a Laravel registration form with the invisible google recaptcha v2 installed with the security set to highest level within the recaptcha admin console - code as follows: <div> <div ...
adam78's user avatar
  • 121
0 votes
1 answer

Hidden Input prevent value changing - Laravel

So I was testing my application for some vulerabilities and found one that I missed: <input class="hidden" type="hidden" name="event_id" value="{{$event->id)}}&...
user avatar
1 vote
2 answers

SQL Injection detected

I was loading my sites front end and watching the responses in burpsuite when I noticed a response which contained a very verbose sql error "message": "SQLSTATE[22P02]: Invalid text ...
David's user avatar
  • 95
0 votes
1 answer

How to secure Laravel website against the ongoing massive exploitation

My website built upon Laravel is currently under attack. Only the index.php file was changed, and by that I mean that every line of code is inserted above the original Laravel code. So this code ...
Hassan Nasir's user avatar
0 votes
1 answer

What should I worry about when attaching a token to a request manually?

I'm developing a platform that has 2 parts: An API written using Laravel, that integrates with the database and provided data in a restful state. Multiple fronts that connect to the API and perform ...
Johansson's user avatar
  • 111
0 votes
0 answers

Taking html, js, css input from the user

We are building a multitenancy web app with Laravel (+Blade), each user can create a store (tenancy), and have a control panel where they can edit the store settings and styling, to edit the store ...
RedZ's user avatar
  • 101
2 votes
2 answers

Is there any way an attacker can access the server and modify the site (php) code? [closed]

I recently had a breach on my site (laravel). I got aware of it after I tried to pull the code from github and found out that some files were modified. The files modified were mostly storage - logs/...
php.prg's user avatar
  • 21
0 votes
2 answers

How do I protect a Laravel backend API from hijacking/CSRF when there is a React frontend?

I'm finding it really hard to find a solution to make secure requests via our API without a potential hacker being able to see sensitive secret information via Google Chrome dev tools (or any browser'...
Bilal's user avatar
  • 3
0 votes
2 answers

Security breach from contact form in Laravel 5.8.36?

the most bizarre thing happened, someone fount out the smtp mail driver credentials from a Laravel project, which are stored in the .env. The credentials are used for a contact form. The .env was in ...
Don40's user avatar
  • 101
0 votes
1 answer

Laravel | Why create a public_html folder and link/move it?

I am using laravel on shared hosting. Under my domain in my folder is the laravel app. Now I see online that many people do weird stuff with the laravel public folder, they either move it to a ...
Roman's user avatar
  • 157
2 votes
0 answers

Identifying Source of Malware Attack on Laravel App

We have a Laravel 5.6.x application running as a REST backend with PHP 7 on one of our servers. The server uses CentOS with WHM/cPanel/PhpMyAdmin Recently that server issued a maldet warning (our ...
Ablancore's user avatar
2 votes
1 answer

Missing HTTPOnly Cookie Attribute in Laravel 7 [duplicate]

I have a Laravel site, I thought I patched this issue already. I got these in my session.php 'secure' => true, 'http_only' => true, But OpenVas still detected that I still need to it. It ...
code-8's user avatar
  • 125
0 votes
1 answer

Is it more secure if I separate VPS into WebApp/MySQL VPS & separating WebApp projects into Admin/User projects

If I want to deploy a Laravel WebApp using MySQL DB on a VPS like DigitalOcean, Vultr or similar platforms, should I separate the VPS into WebApp VPS and MySQL VPS? Is it more secure? And what if I ...
PoundXI's user avatar
1 vote
1 answer

Session sync between two web apps on the same domain

I have a Laravel 6 site, and a legacy Drupal 7 site. Both are served under the same domain, and both share the same user database table. I'd like users to be able to log in via Laravel (never via ...
jeff-h's user avatar
  • 113
0 votes
1 answer

Use another ssl certificate even if server has other certificates

I deployed a laravel project to a server (in which I have root access). Then I was asked to install a ssl certificate to that project. But there are some projects that already have installed a ssl ...
Gun Ho's user avatar
  • 1
1 vote
0 answers

laravel-poc-CVE-2018-15133 [closed]

I want to test laravel exploit POC based on I did docker steps to reach laravel home page on localhost:8000 then I got API key and simply I put ...
james's user avatar
  • 11
2 votes
2 answers

How to detect website active routes?

I'm building a website using Laravel and I'm just thinking about security. I would like to know if there is a way for attacker to detect all active web routes for a website ? For example: http://...
OrangeSpider's user avatar
2 votes
1 answer

Limit rights for user applications

I have a website, where users are available to upload small applications which runs 24/7 on my server. So if the user upload an application, some folders will be created: /{USER_ID}/{APP_ID}/ (if ...
xKushGene's user avatar
-2 votes
2 answers

How to leave a backdoor in a Laravel application?

I'm pretty curious how someone could leave a backdoor in a Laravel application? In my opinion there isn't a way, because the entry point of the requests is a route file, and you have to write code for ...
Comrade's user avatar
  • 97
6 votes
2 answers

Why does this Laravel CSRF vulnerability work?

Recently Laravel 4 was updated to address a security concern: there was a CSRF vulnerability in their code. Here's the old code: if (Session::token() != Input::get('_token')) { throw new ...
Jason's user avatar
  • 63