As someone that’s been using Laravel since v4.2, I love your content , straight to the point, no dithering , no BS - I hope you get your silver platter soon :)
About what you said at 11:15 ("do not use get requests for anything that should be changing the data" ) : we can use a middleware (like "authenticate" or any custom middleware to authorise the get route call.
When using livewire: if you have a model or collection of models defined as public class variable, their attributes are sent to the client and visible with a simple view source as are all the public variables.
Pov, this is good stuff. Can I suggest you do more videos with the theme of "common mistakes". Security is the obvious topic but there are many others where developers do things that while they do not expose security issues nevertheless create problems for the user experience and app stability. This is a serious thing and would increase views to your channel. Thanks for your hard work and I hope you hit 100K subs soon.
Thanks for the idea. I am actually doing more videos like this, just maybe never calling it specifically "common mistakes". Maybe need to make rebranding of the titles :)
Best wishes for getting that silver button soon! You deserve it. I can’t imagine putting out a video *daily*, and such quality content, and well-delivered, too. Your “hello guys” at the beginning is so friendly & familiar - love it. :)
Thank you for this great stuff. I'll more thankful if you also create video of how to overcome this issues specially file access or .env access from shared hosting or public folders.
I have to clean up one project before. Using CORS * on production, doesn't turn off app debug, render directly the db column name to table instead of using alias, only validation on the client size. It took me only 10 seconds to figure it out how to break into the database.
I had the ugly experience of patch a php application that had the 5.x version, no framework and legacy code. it had no validation, no token, no escape variables and most important 0 documentation. It was a nightmare to patch up and migrate to php 8. Everything while the APP was under heavy attack from bad guys
Hi Sir please make one video on how to prevent unauthorized user to access of our code directly mainly from server side. For Example. How to secure server for Laravel projects as well as what are the loopholes how to prevent them etc.
I also want to tell my story. When I first started learning things like TypeScript, I didn’t quite understand how I could make a POST request to the server and pass the CSRF token from the TS file. For this reason, I (I still don’t understand why) made these requests through the api.php file. A little later I found out that requests that are processed in api.php are not protected against csrf attacks. This mechanism works in web.php, while api requests do not require any tokens to run controller methods. To be honest, I still don’t quite understand how I can correctly make such requests if they come from a .ts file. If anyone knows more about this, could you tell me what solutions there are?
Good stuff. Would you ever consider doing a course on security in Laravel, PHP, and Livewire, or even just more videos on it? It's a huge concern that I feel like doesn't get enough attention, and even as a mid-level developer and working with Laravel over 5 years, I'm not always sure how to be sure my code is 100% secure other than avoiding some of the obvious like you point out in this video. Like a good example of content you could cover is how supposedly we should be using UUIDs for our models, but it's not always clear the best way to do that or when to do that
Well, I've covered the main things in this video, so not sure what I would say in a course. For UUIDs, I have that covered in other courses, like here: laraveldaily.teachable.com/courses/how-to-structure-database-in-laravel/lectures/31520548
pls I am used to csrf but with the invention of livewire, is it necessary again because I dint even bother to include it because you can submit form without even form elements using livewire.
If you can't "Imagine what could go wrong if any person could inject any javascript on your page.", think of a javascript initiated POST request changing data on the server using your credentials as it is you that sees the page in your browser.
Well done Povi ! May I ask if you can do a video on how to approach a php/laravel upgrade task. So for example, upgrading from laravel 8 to 9, and what steps you would take.
Thanks. very informative, while watching I thought of .. what if there's a video version (course?) of the Laravel documentation, that's too much though 😅
Thank you so much for your video. Please make a video on passing {id} value in route. We are using direct id which is the primary key for the Post, Put method and Laravel also use the same in resource controller. Please make a video with this topic and security issues.
First of all, big thanks, what about xml attack? And sql injections? Have any vulnerability for sql injections in laravel? If yes, how can it be safer?
There is a case that isn't handled by laravel blade: the href property of the "a" tag. the href value could be equal to something like javascript:alert(1). If the href value comes from users you don't trust you have to make sure it doesn't start with "javascript:" or you could make sure it has a valid URL format
Hello Povilas, Great video! Just 1 question regarding the first example. What about the cases I have a WYSIWYG in my blog post and the user can enter a html? I am forced to escape it. what's the solution?
Hello, Povilas I have a question. Lets say there is a blog post site and user can make a post that contains all those html tags like link, table and so on, how the content should be displayed if {!! $content !!} is a security issue? Should developer write a some code that checks if there are strings like or
I think in this situation, always wrap the content with PHP htmlspecialchars() function before saving it to the database. By doing so it will convert all the tags to special characters. Now when showing, you can use the {!! $content !!} and you will be fine. Even if a user pass a malicious script, it will not execute
@@LaravelDaily I didn't know all those json queries, so not using that. Putting id's in json should slow thing down, wouldn't do that. My question is more about decoding json in api calls, and the associated security problems.
Hello! Maybe you recording video on laravel Policy? How block any action in another user when user is not the same Group. Or how user can get only our post when he post another id in request. I have problem with this and no were information how do this. I have two model Clients and Users, Clientis Group amd have more users. Now when i send GET REQUEST id another client i can get users another client.
thank you. please make this video more advanced. maybe for example, case someome is attacking you by register 2 user every minutes with valid otp (this crazy but it reals dont know how they have random phone number otp), then you block its IP but he changes his IP and last you use recaptcha to prevent the attack.
I won't recommend it too. You have to change the root folder directory and change the app boot directory. I don't like the hack. it's not easily maintainable
Is it a mistake to add data in a migration, or should migrations only change the database structure? For example, we keep our translations in a database table. If we need another word translated, should we add this in a migration? Or should we use a seeder? Or something else?
Every database structure and data that makes the application usable from the start should go in migrations. Seeders are for testing or even demo purposes.
Last week analyzing my apache log I found some requests to /.env, so make sure that your .env file is not public, you never will be 100% safe, so do your best
How to upload a image via mobile camera in website from mobile browser using laravel livewire ? I have tried by adding attribute capture in file input and opened a site in mobile browser and trying to upload it shows file manager and camera option i selected the camera and taken the image and upload livewire showing failed to upload image
@@yasark6347 I don't think Livewire is different from Laravel, it's the back-end framework, the question is what tools you use on the front-end for the upload - a simple input or something more complex. Again, hard to answer in a comment. But yes, it's possible, mobile browser is still a browser.
is Java secured? I am going to leave a general answer "If the developer is bad at coding and doesn't care about securing their application NO", but then again there is a job market for people that are paid to look at the code and yell at those developers that they should not hardcode security keys inside the client app (for example: 2 years ago I was listening to a podcast of a lady that said she found hardcoded security keys inside android banking applications, with comments in the code "stop putting security keys in the code") So to sum it up, most of the time the problem is between the chair and the screen
We disable @csrf on sale forms. Customer might leave browser open for the whole day and only then can submit the form. I know, that there is some javascript packages, which updates csrf codes, but that doesn't gurantee in 100% and we do not want to lose a sale. (not perfect from security side, but sales are more important)
You sure deserve a UA-cam play button. Your content seems to be coming out right when I need something specific like you release, ha
As someone that’s been using Laravel since v4.2, I love your content , straight to the point, no dithering , no BS - I hope you get your silver platter soon :)
Subscribed. Get that play button! You deserve it.
Straightforward, clear, no fluff… I love your style.
About what you said at 11:15 ("do not use get requests for anything that should be changing the data" ) : we can use a middleware (like "authenticate" or any custom middleware to authorise the get route call.
When using livewire: if you have a model or collection of models defined as public class variable, their attributes are sent to the client and visible with a simple view source as are all the public variables.
Pov, this is good stuff. Can I suggest you do more videos with the theme of "common mistakes". Security is the obvious topic but there are many others where developers do things that while they do not expose security issues nevertheless create problems for the user experience and app stability. This is a serious thing and would increase views to your channel. Thanks for your hard work and I hope you hit 100K subs soon.
Thanks for the idea. I am actually doing more videos like this, just maybe never calling it specifically "common mistakes". Maybe need to make rebranding of the titles :)
@@LaravelDailyns
S
L
😊😂😮😢
Yo4
never played a full tutorial video without x2 speed outside work. very good video i subed
Best wishes for getting that silver button soon! You deserve it. I can’t imagine putting out a video *daily*, and such quality content, and well-delivered, too. Your “hello guys” at the beginning is so friendly & familiar - love it. :)
Surely you will reach there soon sir, we always behind you and we will keep supporting to reach your goals. Thank you for the valuable contents.
YOU WIll surely go beyond 200K subscribers Sir, you are really doing a great job. Thanks and God bless
I really appreciate your every single video. They are so helpful to me.
all() is one of my bad. Thank you so much for this tips. I will correct myself
I didn't know about rate limiting feature, thank you a lot. I've just shared your video
One common mistake I see people doing, is not protecting the {id} in routes. Which means a user can affect data of another user
No, if you make validation in the backend
What if you use UUID for the ID so that it is not sequential?
That's why we have authorization
And you can also use route model binding {user}
Thank you for this great stuff. I'll more thankful if you also create video of how to overcome this issues specially file access or .env access from shared hosting or public folders.
I don't work with shared hosting (and I don't recommend anyone else doing it), so I can't make a video on it.
This is sooo goood..awesome work!
this channel deserve a "varified tick".
thanks a lot.
Great video as always, would love to see more of these!
I have to clean up one project before. Using CORS * on production, doesn't turn off app debug, render directly the db column name to table instead of using alias, only validation on the client size. It took me only 10 seconds to figure it out how to break into the database.
Wow this is very insightful sir. Thanks for sharing
I had the ugly experience of patch a php application that had the 5.x version, no framework and legacy code. it had no validation, no token, no escape variables and most important 0 documentation. It was a nightmare to patch up and migrate to php 8. Everything while the APP was under heavy attack from bad guys
Thank you sir, i think your videos is very usefull. Thanks for your dedication.
Hi Sir please make one video on how to prevent unauthorized user to access of our code directly mainly from server side.
For Example. How to secure server for Laravel projects as well as what are the loopholes how to prevent them etc.
I also want to tell my story. When I first started learning things like TypeScript, I didn’t quite understand how I could make a POST request to the server and pass the CSRF token from the TS file. For this reason, I (I still don’t understand why) made these requests through the api.php file. A little later I found out that requests that are processed in api.php are not protected against csrf attacks. This mechanism works in web.php, while api requests do not require any tokens to run controller methods. To be honest, I still don’t quite understand how I can correctly make such requests if they come from a .ts file. If anyone knows more about this, could you tell me what solutions there are?
Amazing mentions. Thank you
i wonder if you can make the same video for developers who use laravel just for API as a backend and tell us about security concerns we may face
Good stuff. Would you ever consider doing a course on security in Laravel, PHP, and Livewire, or even just more videos on it? It's a huge concern that I feel like doesn't get enough attention, and even as a mid-level developer and working with Laravel over 5 years, I'm not always sure how to be sure my code is 100% secure other than avoiding some of the obvious like you point out in this video. Like a good example of content you could cover is how supposedly we should be using UUIDs for our models, but it's not always clear the best way to do that or when to do that
Well, I've covered the main things in this video, so not sure what I would say in a course.
For UUIDs, I have that covered in other courses, like here: laraveldaily.teachable.com/courses/how-to-structure-database-in-laravel/lectures/31520548
pls I am used to csrf but with the invention of livewire, is it necessary again because I dint even bother to include it because you can submit form without even form elements using livewire.
In Livewire csrf isn't needed, Livewire takes care of that, internally.
@@LaravelDaily thanks for the clarification
excuse me sir, how to install laravel vue js with tailwind css .. same as using npm?
If you can't "Imagine what could go wrong if any person could inject any javascript on your page.", think of a javascript initiated POST request changing data on the server using your credentials as it is you that sees the page in your browser.
gr8 video ,which i listen till date..
Can you make a video about Content Security Policy (CSP) in livewire or laravel in general.
Just wanted to add, never put sensitive data in cookies. An experienced attacker will thank you for leaking out information using cookies.
I always enjoy your content ♥️.
Need to know more about file upload security
Well done Povi ! May I ask if you can do a video on how to approach a php/laravel upgrade task. So for example, upgrading from laravel 8 to 9, and what steps you would take.
ua-cam.com/video/mPBkYdrOEdQ/v-deo.html this is my video on a similar topic.
Also I recommend laravelshift.com
@@LaravelDaily Oh awesome you already have this covered. Nice 👌
Thanks. very informative, while watching I thought of .. what if there's a video version (course?) of the Laravel documentation, that's too much though 😅
Would you watch all those 23 hours? :) www.omnicalculator.com/everyday-life/reading-time?c=EUR&v=reading_speed_descrip:0.5,pages_read:700
Thanks Sir you helping so much .... i really appreciate it
How to perform vulnerability assessment?
If there's anyone who deserves 100K + subscribers and that youtube sliver play button, its got to be you brother man
Nice info sir, thanks!
Thank you so much for your video. Please make a video on passing {id} value in route. We are using direct id which is the primary key for the Post, Put method and Laravel also use the same in resource controller. Please make a video with this topic and security issues.
Already scheduled for the next week
@@LaravelDaily Thanks a lot
@@LaravelDaily Have you done this? if yes, please where's the link?
First of all, big thanks, what about xml attack? And sql injections? Have any vulnerability for sql injections in laravel? If yes, how can it be safer?
There is a case that isn't handled by laravel blade: the href property of the "a" tag. the href value could be equal to something like javascript:alert(1). If the href value comes from users you don't trust you have to make sure it doesn't start with "javascript:" or you could make sure it has a valid URL format
That’s a good idea Sonia. But how will you check that?
@@guccilive100 Laravel validation has a "url" validation rule, you can use that to force href values to only be valid urls
Thanks a lot for sharing knowledge with us
Why are you so good? 💚💚💚
Great video!
Awesome topic sir.
Hello Povilas,
Great video! Just 1 question regarding the first example. What about the cases I have a WYSIWYG in my blog post and the user can enter a html? I am forced to escape it. what's the solution?
@laravel daily
Hello, Povilas I have a question. Lets say there is a blog post site and user can make a post that contains all those html tags like link, table and so on, how the content should be displayed if {!! $content !!} is a security issue? Should developer write a some code that checks if there are strings like or
Yes you should enable only certain tags. I'm planning to shoot a video about it, some time later in 2022.
I think in this situation, always wrap the content with PHP htmlspecialchars() function before saving it to the database. By doing so it will convert all the tags to special characters. Now when showing, you can use the {!! $content !!} and you will be fine. Even if a user pass a malicious script, it will not execute
Respect from Pakistan 🇵🇰
Rate Limiting is left from my side, all other stuff is my daily routine.
Thanks for the info sir
Very informative
amazing stuff thank you Povilas
I am using json in a crud app. Still a bit unsure about possible vulnerabilities. Do you have any information?
I don't like or personally use json so can't advise really
@@LaravelDaily What's not to like? Thanks anyway.
ua-cam.com/video/9uhXI4nDpOQ/v-deo.html my video about it
@@LaravelDaily I didn't know all those json queries, so not using that. Putting id's in json should slow thing down, wouldn't do that.
My question is more about decoding json in api calls, and the associated security problems.
Oh THAT json. Then the main thing is to validate the data from that json, for whatever malicious things you may find there.
Hello! Maybe you recording video on laravel Policy? How block any action in another user when user is not the same Group. Or how user can get only our post when he post another id in request. I have problem with this and no were information how do this. I have two model Clients and Users, Clientis Group amd have more users. Now when i send GET REQUEST id another client i can get users another client.
I don't have a video specifically for your situation, but I have a general one: ua-cam.com/video/kZOgH3-0Bko/v-deo.html
Rate limit is a good option to negotiate delayed payments :P
What do we do when we use wyswyg form editor and finally we have to show unescaped data?
Validate the content first for accepted tags. Disable script tags etc
thank you. please make this video more advanced. maybe for example, case someome is attacking you by register 2 user every minutes with valid otp (this crazy but it reals dont know how they have random phone number otp), then you block its IP but he changes his IP and last you use recaptcha to prevent the attack.
I don't want to get deeper into hacking topic, that's not my topic or my strong skill.
What's the best secured way to upload laravel project in shared hosting?
I don't use shared hosting and don't recommend it to anyone
I won't recommend it too. You have to change the root folder directory and change the app boot directory. I don't like the hack. it's not easily maintainable
Thank you!
Is it a mistake to add data in a migration, or should migrations only change the database structure? For example, we keep our translations in a database table. If we need another word translated, should we add this in a migration? Or should we use a seeder? Or something else?
Every database structure and data that makes the application usable from the start should go in migrations. Seeders are for testing or even demo purposes.
Totally fine in migrations
Last week analyzing my apache log I found some requests to /.env, so make sure that your .env file is not public, you never will be 100% safe, so do your best
where do you find the .env in production i can never find mine myself i see it in testing but it seems to disappear during live server upload
@@artificallead499 You may not see it on your repo if you hide it in .gitignore but on your live server it will be there
Does using Eloquent and Query builder safe enough to prevent SQL injection ?
Yes
You are just awesome
Thank you so much sir
How to upload a image via mobile camera in website from mobile browser using laravel livewire ?
I have tried by adding attribute capture in file input and opened a site in mobile browser and trying to upload it shows file manager and camera option i selected the camera and taken the image and upload livewire showing failed to upload image
Sorry it's impossible to blindly debug your situation in a UA-cam comment
@@LaravelDaily thanks for your reply . Is there a way to upload a image from mobile camera from website using laravel livewire. ?
@@yasark6347 I don't think Livewire is different from Laravel, it's the back-end framework, the question is what tools you use on the front-end for the upload - a simple input or something more complex. Again, hard to answer in a comment. But yes, it's possible, mobile browser is still a browser.
@@PovilasKorop thanks to you
WooooW, thank you.
You are legit ! Definitly !
awesome 👍
nice video! are there any chance you make a video about microservice with laravel?
I haven't used microservices in Laravel so can't make a video about it
@@LaravelDaily ok thanks
great info.
Another: People using Raw DB queries and not binding parameters subsequently leading to an SQLi.
very very top! :)
thank you...
Hi povilaz....can you make one video about laravel project hosting in shared server, it's very helpful to all
Thanks in advance.
I don't use shared hosting and don't recommend it to anyone.
Thanks bro
thank you
How store data written by text editors, safely?
strip script tags.
Thanks
* runs to double check all of my Code *
is Java secured?
I am going to leave a general answer "If the developer is bad at coding and doesn't care about securing their application NO", but then again there is a job market for people that are paid to look at the code and yell at those developers that they should not hardcode security keys inside the client app (for example: 2 years ago I was listening to a podcast of a lady that said she found hardcoded security keys inside android banking applications, with comments in the code "stop putting security keys in the code")
So to sum it up, most of the time the problem is between the chair and the screen
But I feel like request except is also a security loophole
Yes if you don't provide the dangerous properties in except
@@LaravelDaily which in most cases is all other fields in dB
So, .env file should be renamed as: env.php
Great
Show!
We disable @csrf on sale forms. Customer might leave browser open for the whole day and only then can submit the form. I know, that there is some javascript packages, which updates csrf codes, but that doesn't gurantee in 100% and we do not want to lose a sale. (not perfect from security side, but sales are more important)
Better to extend the lifetime of the csrf token. m
@@ChrisT-ib1zh good point
love from pakistan
please make one about file upload exploit
7 Mistakes beginners devs make :)
Want more similar lessons? My Laravel courses membership: laraveldaily.com/courses
I forgot to say that the Laravel 10 I am using
👋👋
noice
Me who use REST API'S: 🤷
S
Thank you!