skills.rest
sebauvray
sebauvrayCOMMUNITY
Explore all skills by this author →
GitHub

securite-api

Audits Laravel API code for authorization, IDOR, mass assignment, and data disclosure vulnerabilities.

Updated May 5, 2025
Search Tags:#authorization#multi-tenant#security audit#laravel#sanctum#idor#mass assignment
One-click install
npx skills add https://github.com/sebauvray/toollab-api --skill securite-api-sebauvray
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: securite-api
Source: https://github.com/sebauvray/toollab-api/tree/main/.claude/skills/securite-api
Command: npx skills add https://github.com/sebauvray/toollab-api --skill securite-api-sebauvray

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Shipping Laravel API code without a consistent security review leads to cross-tenant data leaks, IDOR vulnerabilities, mass assignment flaws, and error messages that disclose internal details. This Skill provides the Toollab security model and an audit checklist to apply before delivering any code touching authentication, authorization, or file uploads. ## Core Features & Use Cases - Authorization & IDOR review: Enforces the four middleware layers (auth:sanctum, school, schoolyear, checkrole) plus application-level gates, with explicit checks for models lacking global scopes. - Mass assignment & validation rules: Keeps technical fields like school_id out of $fillable and requires Rule::exists constraints scoped to the current school. - Non-disclosure & auth hardening: Standardizes generic error messages, Sanctum token revocation on password operations, rate limiting, CORS whitelists, upload mimes rules (SVG forbidden), and Vue XSS guidance. - Use Case: Before merging a new endpoint that updates a family record, run the audit checklist to verify tenant scoping, generic 403 responses, throttle middleware, and token revocation behavior. ## Quick Start Review this controller change against the securite-api security checklist and flag any IDOR, mass assignment, or error disclosure issues.

Frequently Asked Questions about securite-api

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent IDOR vulnerabilities in a Laravel multi-tenant API?▼

Validate every client-supplied id with a tenant constraint, such as Rule::exists('cursus','id')->where('school_id', currentSchoolId()). For models without a global scope, explicitly compare school_id and verify parent-child links before returning resources.

How to check mass assignment risks in Laravel models?▼

Keep technical fields like school_id, school_year_id, created_by, and updated_by out of $fillable; let traits or explicit code set them. Never pass $request->all() to create or update; use $request->validated() with a restricted $fillable.

What error messages should a Laravel API return for access denied?▼

Return a generic 403 'Accès refusé' and merge 'not found' with 'no access' so attackers cannot enumerate resources. Log the real details with Log::warning including user id and path, but never expose model names, headers, or exception traces to clients.

Does Laravel Sanctum revoke tokens after a password change?▼

In this codebase, changePassword revokes all tokens except the current one, while resetPassword and setPassword revoke all tokens. Any new sensitive password operation must also revoke tokens to invalidate potentially compromised sessions.

Why is SVG forbidden in file upload validation?▼

SVG files can embed scripts, enabling stored XSS when served back to browsers. The upload rules whitelist only jpeg, png, jpg, gif, and webp; reintroducing SVG would require a sanitizer library such as enshrined/svg-sanitize.

When should I run this security audit checklist?▼

Run it before delivering any code touching authentication, authorization, file uploads, or during a security review. It covers tenant scoping, $fillable hygiene, generic error messages, throttling on public routes, and pending-invitation data masking.

Related Skills

Explore More Software Engineering Skills→
musher-devmusher-dev

governing-tenant-routes

Govern multi-tenant API route design with path-derived tenant context and dual-validation middleware.

Official
Advanced
TrevorPLamTrevorPLam

agent-security

Audit code changes for security vulnerabilities, secrets, and anti-patterns.

Community
Advanced
SaidabbosSaidabbos

permission-system

Automate role-based access control in Laravel with Spatie Laravel Permission.

Community
Intermediate
xlelibertyxleliberty

security-pen-testing

Perform offensive security assessments with vulnerability scanning and penetration testing.

Community
Advanced