PHP code example of sagor / laravel-security

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

    

sagor / laravel-security example snippets

use Sagor\LaravelSecurity\Http\Middleware\SecurityMiddleware;
use Sagor\LaravelSecurity\Http\Middleware\SecurityUploadMiddleware;
use Sagor\LaravelSecurity\Http\Middleware\SecurityApiMiddleware;

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        web: __DIR__.'/../routes/web.php',
        commands: __DIR__.'/../routes/console.php',
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware) {
        // Global web protection
        $middleware->web(append: [
            SecurityMiddleware::class,
        ]);

        // Middleware Aliases
        $middleware->alias([
            'security' => SecurityMiddleware::class,
            'security.upload' => SecurityUploadMiddleware::class,
            'security.api' => SecurityApiMiddleware::class,
        ]);
    })->create();

protected $middlewareGroups = [
    'web' => [
        // ...
        \Sagor\LaravelSecurity\Http\Middleware\SecurityMiddleware::class,
        \Sagor\LaravelSecurity\Http\Middleware\SecurityUploadMiddleware::class,
    ],
];

protected $routeMiddleware = [
    'security' => \Sagor\LaravelSecurity\Http\Middleware\SecurityMiddleware::class,
    'security.upload' => \Sagor\LaravelSecurity\Http\Middleware\SecurityUploadMiddleware::class,
    'security.api' => \Sagor\LaravelSecurity\Http\Middleware\SecurityApiMiddleware::class,
];

Route::middleware(['security', 'security.upload'])->group(function () {
    Route::resource('products', ProductController::class);
    Route::post('/upload', [UploadController::class, 'store']);
});

return [
    'enabled' => env('SECURITY_ENABLED', true),
    
    // Operating Mode: 'monitor' (log only), 'balanced' (block high/critical), or 'strict' (block medium+)
    'mode' => env('SECURITY_MODE', 'balanced'),

    'dashboard' => [
        'path' => 'security',
        'middleware' => ['web'],
    ],

    'firewall' => [
        'sql_injection' => true,
        'xss' => true,
        'path_traversal' => true,
        'command_injection' => true,
        'ssrf' => true,
        'scanner_detection' => true,
        'bot_detection' => true,
    ],

    'uploads' => [
        'max_size' => 20480, // KB
        'allowed_extensions' => ['jpg', 'jpeg', 'png', 'webp', 'pdf', 'doc', 'docx', 'zip'],
        'validate_signature' => true,
        'quarantine' => true,
    ],

    'rate_limiting' => [
        'enabled' => true,
        'max_attempts' => 60,
        'decay_minutes' => 1,
    ],

    'route_obfuscation' => [
        'enabled' => false,
        'prefix' => 'r',
        'routes' => ['admin.users'],
        'exclude' => ['login', 'logout', 'api.*'],
    ],
];

namespace App\Security\Rules;

use Sagor\LaravelSecurity\Contracts\SecurityRule;
use Sagor\LaravelSecurity\Firewall\SecurityContext;
use Sagor\LaravelSecurity\Firewall\SecurityRuleResult;

class BlockForbiddenKeywords implements SecurityRule
{
    public function getId(): string
    {
        return 'custom.forbidden_keywords';
    }

    public function getDescription(): string
    {
        return 'Blocks requests containing internal restricted payload terms.';
    }

    public function check(SecurityContext $context): SecurityRuleResult
    {
        $payload = json_encode($context->getNormalizedPayload());

        if (str_contains($payload, 'INTERNAL_SECRET_KEY')) {
            return SecurityRuleResult::threat(
                $this->getId(),
                'critical',
                1.0,
                95,
                'Forbidden internal keyword detected in payload.'
            );
        }

        return SecurityRuleResult::clean($this->getId());
    }
}

use Sagor\LaravelSecurity\Facades\LaravelSecurity;
use App\Security\Rules\BlockForbiddenKeywords;

public function boot()
{
    LaravelSecurity::addRule(new BlockForbiddenKeywords());
}

Route::resource('products', ProductController::class);
// Or individual dynamic routes:
Route::get('/products/{id}/edit', [ProductController::class, 'edit'])->name('products.edit');

'route_encryption' => [
    'enabled' => true,
    'prefix' => 'e', // Generates URLs like /e/eyJpZCI6NX0...
    'routes' => [
        'products.show',
        'products.edit',
        'products.*', // Encrypt all product resource routes!
        'admin.*',
    ],
    'auto_encrypt_route_helper' => true,
],

bash
php artisan security:install