laravel-security

Issue tokens with specific abilities using $user->createToken('name', ['posts:read']), then protect routes with the auth:sanctum middleware and abilities:posts:read checks. Set a token expiration in config/sanctum.php and restrict stateful domains to your own hosts.

Define a $fillable whitelist on each model and never use $guarded = []. Create records only from validated data via $request->validated() or $request->safe()->only([...]), and never pass $request->all() to create() or update().

Sanctum is recommended for most apps, including SPAs and simple token-based APIs, because it is lightweight and first-party. Passport is appropriate when you need full OAuth2 flows for third-party clients or complex authorization grants.

Use {{ }} escaped output for all user input and reserve {!! !!} only for trusted, server-controlled HTML. For user-supplied HTML, purify it with HTMLPurifier using a whitelist of allowed tags, and use @js or @json when embedding data in JavaScript.

Set APP_DEBUG=false, generate APP_KEY with php artisan key:generate, enforce HTTPS via middleware or URL::forceScheme, use secure and http_only session cookies, and add security headers like CSP and X-Frame-Options. Run composer audit in CI to catch vulnerable dependencies.

CSRF errors occur when forms lack the @csrf directive or AJAX requests omit the X-CSRF-TOKEN header from the csrf-token meta tag. Only exclude routes in VerifyCsrfToken when they have their own verification, such as Stripe webhook signatures.