Weave Code
Security Laravel Package
artisanpack-ui/security
Core Laravel security toolkit for ArtisanPack UI: sanitization, escaping (Laminas Escaper), KSES filtering, validation rules, security/CSP middleware, CSP builder with nonce & reporting, rate limiting, audit/scan commands, and testing helpers.
Core security utilities for Laravel — input sanitization, output escaping, KSES HTML filtering, CSP, and security headers middleware.
Frequently asked questions about Security
- How do I replace manual `htmlspecialchars` calls with this package’s escaping functions?
- Replace `htmlspecialchars($input, ENT_QUOTES, 'UTF-8')` with `Security::escHtml($input)`. The package uses Laminas Escaper under the hood for consistent, secure escaping across HTML, attributes, URLs, JavaScript, and CSS contexts. For Blade templates, use the `@escHtml` directive.
- Does this package support Laravel 11 or 12? Are there breaking changes from Laravel 10?
- Yes, it’s fully compatible with Laravel 10, 11, and 12. The package follows Laravel’s semantic versioning, so minor updates (e.g., 2.x to 2.1) won’t introduce breaking changes. Major versions (e.g., 2.x to 3.x) may require adjustments, but the team documents migrations in UPGRADE.md.
- Can I use the CSP middleware without Livewire? What’s the impact on performance?
- Absolutely. The CSP middleware works independently of Livewire—you only need Livewire if you want the optional CSP dashboard. Performance overhead is minimal; nonce generation and policy evaluation use Laravel’s cache. For high-traffic apps, monitor `csp:stats` to optimize cache settings.
- How do I configure CSP policies to allow third-party scripts (e.g., Google Analytics) without breaking security?
- Use the `csp:test` command to validate policies before deployment. For third-party scripts, add them to the `script-src` directive in `config/artisanpack/security.php` under `policies['default']`. Example: `'script-src': ['self', 'https://www.googletagmanager.com']`. Always test with `csp:test` to catch violations.
- Is there a way to audit my existing Laravel app for XSS vulnerabilities before integrating this package?
- Yes. Run `php artisan security:audit` to scan for common XSS patterns, missing escaping, or insecure output. The `security:scan` command also checks for outdated dependencies or misconfigured middleware. Integrate these into your CI/CD pipeline for automated security checks.
- How does the `api.rate_limit` middleware differ from Laravel’s built-in rate limiting?
- The `api.rate_limit` middleware extends Laravel’s rate limiting with security-specific features like IP-based throttling, anomaly detection, and integration with the `security-analytics` package for logging. It’s designed for APIs where brute-force or scraping attacks are a risk, with configurable limits per route or globally.
- Can I use this package alongside `spatie/laravel-html` or `laravel-validator`? Will there be conflicts?
- No direct conflicts, but evaluate overlap. This package provides sanitization (e.g., `sanitizeText`) and escaping (e.g., `escHtml`) as global helpers, while `spatie/laravel-html` focuses on HTML filtering. Use `sanitizeEmail` or `SecureUrl` validation rules here instead of custom logic. For validation, prioritize one package to avoid redundancy.
- What’s the best way to migrate from ArtisanPack UI Security 1.x to 2.0?
- Follow the UPGRADE.md guide. Key changes include splitting auth into `security-auth`, so replace `Security::auth()` calls with the new package. Update middleware aliases (e.g., `csp` instead of `artisanpack.csp`). Run `php artisan security:baseline` to compare your current config against 2.0 defaults.
- Does this package support non-Laravel PHP applications, or is it Laravel-only?
- It’s Laravel-first, leveraging facades, middleware, and Blade directives. However, the core escaping/sanitization functions (e.g., `Security::escHtml`) can be used in non-Laravel PHP 8.2+ apps by requiring the package via Composer and instantiating the `Security` facade manually. Middleware and Artisan commands are Laravel-specific.
- How do I test CSP policies in a CI/CD pipeline? Can I automate violation reporting?
- Use `php artisan csp:test` in your pipeline to validate policies against a test suite. For violation reporting, enable the `security:scan` command in CI and configure the `csp.report-uri` in your CSP policy to log violations to a service like Sentry or a custom endpoint. The package includes helpers to parse and analyze CSP reports.
Weaver
How can I help you explore Laravel packages today?