Interactive Verification Tool • 28 Items

Production Security Checklist

Verify your web application against these 28 production security controls before deploying to production. Your progress is saved automatically in your browser.

1 1. Authentication, Sessions & Identity

Argon2id Password Hashing (memory_cost >= 65536, time_cost >= 4)

Enforce memory-hard Argon2id key derivation parameters in config/hashing.php over legacy bcrypt.

FIDO2 WebAuthn Passkeys / Multi-Factor Authentication

Offer phish-resistant biometric Passkeys alongside standard credentials.

Session Fixation Mitigation & Regeneration

Invoke $request->session()->regenerate() upon every authentication state transition.

Strict Cookie Security Flags (__Host-, HttpOnly, Secure, SameSite=Strict/Lax)

Prevent script accessibility and ensure session cookies are only transmitted over TLS.

Redis-Backed Distributed Session Storage

Avoid local file sessions in scaled production environments; protect against session tampering.

Centralized Session Revocation & Invalidation

Provide users with 'Log out other devices' functionality via $request->session()->flush().

2 2. Input Validation, Injection Defense & Uploads

Strict Zero-Trust FormRequest Validation Rules

Validate every incoming parameter with type constraints, string bounds, and regex patterns.

Eloquent Query Parameterization (Zero Raw Concatenation)

Defeat SQL injection by strictly using PDO parameter bindings on all dynamic WHERE clauses.

Blade Context-Aware HTML Escaping (Avoid Unchecked {!! !!})

Rely on double-brace {{ }} syntax for automatic HTML entities conversion; never print untrusted user input with {!! !!}.

Synchronizer CSRF Tokens & AJAX X-CSRF-TOKEN Headers

Enforce VerifyCsrfToken middleware on all state-changing POST, PUT, PATCH, and DELETE endpoints.

File Upload MIME Verification via Magic Bytes (finfo)

Never trust client-reported file extensions; verify underlying magic bytes and store on private cloud disks.

Cryptographic Filename Hashing (Str::uuid() / Str::random())

Strip original filenames to block directory traversal and malicious extension spoofing.

3 3. API Security & OWASP Top 10

Laravel Sanctum 4.x Token Authorization & Scopes

Issue cryptographically signed tokens with least-privilege token abilities/scopes.

BOLA / IDOR Defense via Policy Authorization Gates

Always call $this->authorize('view', $model) before serving records.

Tiered Dynamic Rate Limiting (RateLimiter::for)

Protect public authentication and API endpoints against brute-force and credential stuffing.

Mass Assignment Protection (Strict $fillable Allowlist)

Explicitly declare model fillable attributes to prevent privilege escalation.

SSRF Defense with IP Address Allowlisting

Filter target URLs against loopback (127.0.0.1) and internal cloud metadata ranges before HTTP requests.

4 4. AI, LLM & RAG Application Security

Cryptographic Boundary Nonces for User Prompts

Enclose untrusted user input within random cryptographic delimiter tags to stop direct prompt injection.

Strict Role Segregation (System vs User Prompts)

Never concatenate untrusted user text into the System instruction prompt context.

Redis Sliding-Window Token & Cost Budgets

Limit token consumption per user per hour to mitigate Denial of Wallet attacks.

Vector Database Multi-Tenant Isolation (pgvector / Eloquent)

Enforce mandatory tenant_id WHERE filters on every vector similarity query.

PII Redaction Pipeline (Deterministic Reversible Tokenization)

Scrub national IDs, phone numbers, IBANs, and emails with deterministic reversible replacement.

Model Output Validation as Untrusted Input

Never pass LLM output into raw Blade templates or unparameterized queries. Always validate schemas.

5 5. Infrastructure, CI/CD & Production Hardening

TLS 1.3-First & RSA 4096 / ECDSA P-256 Keys

Disable legacy TLS 1.0 and 1.1; enforce modern forward-secrecy cipher suites.

Automated Dependency Auditing (composer audit --locked)

Enforce weekly CI audits with GitHub Actions to block vulnerable packages from deploying.

Secret Management (Zero Plaintext .env in Git)

Use environment variables injected via AWS SSM, HashiCorp Vault, or encrypted Laravel env files.

Production OPcache Hardening

Set opcache.validate_timestamps=0 in production to eliminate filesystem race conditions.

Model Encrypted Casts for Sensitive PII at Rest

Use Laravel 'encrypted' casts on all sensitive database fields.

Curated by Umar Farooq

Senior Full-Stack & Security Engineer with 5+ years of production experience in Laravel, PHP, and modern web application security. Author of the Laravel AI Security Masterclass.

Email • Portfolio • GitHub • X.com • LinkedIn • Company (Worldwebtree)