Download the PHP package shammaa/laravel-security without Composer

Laravel Security Package

Comprehensive security package for Laravel - Automatically protects against all types of security vulnerabilities!

⚡ Quick Installation (3 Steps Only!)

🚀 Usage - Super Easy!

Method 1: 100% Automatic (Easiest)

Just add one middleware in app/Http/Kernel.php or bootstrap/app.php:

That's it! Now all your requests are automatically protected from:

• ✅ SQL Injection - Detect and prevent SQL injection attacks
• ✅ XSS (Cross-Site Scripting) - Filter malicious scripts and HTML
• ✅ Command Injection - Block dangerous system commands
• ✅ Path Traversal - Prevent directory traversal attacks (../)
• ✅ CSRF (Cross-Site Request Forgery) - Enhanced CSRF protection with token rotation
• ✅ XXE (XML External Entity) - Protect against XML external entity attacks
• ✅ SSRF (Server-Side Request Forgery) - Block internal network access
• ✅ IDOR (Insecure Direct Object Reference) - Validate resource ownership
• ✅ File Upload Attacks - Secure file validation with MIME type checking
• ✅ Brute Force Attacks - Account lockout after failed attempts
• ✅ Rate Limiting - Prevent API abuse and DDoS
• ✅ Security Headers - Automatic CSP, HSTS, X-Frame-Options, etc.
• ✅ Input Sanitization - Clean all user inputs automatically
• ✅ IP Blocking - Auto-block malicious IPs
• ✅ Security Monitoring - Log and track all security threats

Method 2: Using Helper Functions (Very Simple)

Method 3: Using Facade (Simplest)

📋 Complete Features List

Core Security Protections

• ✅ Automatic Protection - Just add one middleware and everything works!
• ✅ SQL Injection Protection - Detect and prevent SQL injection attacks with pattern matching
• ✅ XSS Protection - Filter malicious scripts, iframes, and JavaScript code
• ✅ Command Injection Protection - Block dangerous system commands (exec, system, etc.)
• ✅ Path Traversal Protection - Prevent directory traversal attacks (../, ..\)
• ✅ CSRF Protection - Enhanced CSRF protection with token rotation and double submit cookie
• ✅ XXE Protection - Protect against XML External Entity attacks
• ✅ SSRF Protection - Block Server-Side Request Forgery to internal networks
• ✅ IDOR Protection - Validate resource ownership and prevent insecure direct object references

File & Upload Security

• ✅ File Upload Security - Secure file validation with MIME type and extension checking
• ✅ Magic Bytes Validation - Verify file content matches extension
• ✅ Executable File Blocking - Automatically block dangerous file types
• ✅ Secure File Storage - Automatic file renaming and secure directory storage

Authentication & Authorization

• ✅ Brute Force Protection - Account lockout after failed login attempts
• ✅ Password Strength Validation - Enforce strong password policies
• ✅ Session Security - Enhanced session protection
• ✅ Authorization Policies - Ready-to-use security policies

Rate Limiting & DDoS Protection

• ✅ Rate Limiting - Advanced rate limiting per IP, user, or route
• ✅ IP Whitelist/Blacklist - Manage trusted and blocked IPs
• ✅ Exponential Backoff - Smart retry logic

Security Headers

• ✅ Content Security Policy (CSP) - Prevent XSS and data injection
• ✅ Strict Transport Security (HSTS) - Force HTTPS connections
• ✅ X-Frame-Options - Prevent clickjacking attacks
• ✅ X-Content-Type-Options - Prevent MIME type sniffing
• ✅ Referrer-Policy - Control referrer information
• ✅ Permissions-Policy - Control browser features

Monitoring & Logging

• ✅ Security Monitoring - Real-time threat detection and logging
• ✅ Security Events - Track all security-related events
• ✅ IP Blocking - Automatic IP blocking for repeated threats
• ✅ Security Reports - Generate comprehensive security reports
• ✅ Threat Statistics - View security statistics and analytics

Input Validation

• ✅ Input Sanitization - Clean all user inputs automatically
• ✅ HTML Tag Stripping - Remove dangerous HTML tags
• ✅ SQL Keyword Filtering - Remove SQL keywords from inputs
• ✅ Data Type Validation - Validate input data types

Additional Features

• ✅ Helper Functions - Easy-to-use helper functions
• ✅ Facade Support - Clean API with Facade pattern
• ✅ Artisan Commands - Security scanning, reporting, and management
• ✅ Event System - Listen to security events
• ✅ Policy System - Extensible security policies
• ✅ Validator Classes - Reusable validators for all security checks

⚙️ Configuration (Optional)

Everything works automatically! But if you want to customize, edit config/security.php:

Whitelisting Routes for Admin Panels & WYSIWYG Editors

If you're using admin panels with rich text editors (like CKEditor, TinyMCE) or DataTables, you may need to whitelist certain routes to bypass strict security checks.

Option 1: Using Environment Variables (Recommended)

Add these to your .env file:

Option 2: Using Config File

Edit config/security.php:

Example: CKEditor Setup

Example: DataTables Setup

Important Notes:

• Whitelist only admin routes that you trust
• Use specific route patterns instead of wildcards when possible
• Always validate user permissions before allowing access to whitelisted routes
• Consider using middleware groups for better organization

Excluding Routes from All Security Checks

If you have routes that need to completely bypass all security checks (e.g., AI APIs, webhooks, large content uploads), you can use the excluded_routes feature:

Option 1: Using Environment Variables (Recommended)

Add this to your .env file:

Option 2: Using Config File

Edit config/security.php:

When to Use Excluded Routes

Use excluded_routes when:

• ✅ Sending large content to AI APIs (e.g., long text, recipes, articles)
• ✅ Receiving webhooks from external services
• ✅ Handling file uploads with custom validation
• ✅ Processing data that may contain SQL-like keywords or special characters

⚠️ Security Warning:

• Only exclude routes that you absolutely trust
• Implement your own validation for excluded routes
• Never exclude user-facing routes without proper authentication
• Use specific patterns instead of broad wildcards

Example: AI API Integration

🛠️ Commands

Security Scan

Generate Security Report

Unblock IP

Clean Security Logs

💡 Practical Examples

Example 1: File Upload Security (Super Easy!)

Example 2: Rate Limiting for API

Example 3: Brute Force Protection (Super Easy!)

Example 4: Manual Input Sanitization

Example 5: Filter Output from XSS

📚 More Information

Policies

The package includes ready-to-use policies that you can customize:

• SecurityPolicy - General security operations
• FileUploadPolicy - File upload permissions
• ApiSecurityPolicy - API access control
• AdminSecurityPolicy - Admin operations

Events

The package fires events when threats are detected:

• SecurityThreatDetected - When any threat is detected
• SqlInjectionAttempt - SQL injection attempt
• XssAttempt - XSS attempt
• BruteForceAttempt - Brute force attack
• UnauthorizedAccessAttempt - Unauthorized access attempt

You can listen to these events:

🎯 Summary

Basic Usage:

1. Install the package
2. Add one middleware
3. Done! Everything works automatically

For Advanced Users:

• Use Helper Functions or Facade
• Customize settings in config/security.php
• Use Commands for monitoring and reports

📄 License

MIT

👤 Author

Shadi Shammaa