Introduction
In this final chapter, we will take a closer look at three other important topics: Secrets management, File upload security, dependency vulnerabilities. Personally I got particularly excited about dependency vulnerabilities and the opportunity to overhaul how we use dependencies.
Secrets Management
It’s important to handle sensitive information like API keys, database credentials and other access tokens securely. Accidentally exposing these can have serious consequences. This is where secrets management comes in.
Secrets management allows you to use confidential information, without hardcoding it into your application. GitHub Actions Secrets is a well-known example, allowing you to securely store and access secrets during automated workflows and deployments. However, many alternatives are available.
A simpler and common approach would be to store sensitive information in a .env file. However, make sure to add the .env file to .gitignore, and make sure the file isn’t accessible to unauthorized users.
Do keep in mind that a .env file isn’t a dedicated secrets manager. Its security depends on proper file permissions, server configuration, and access controls.
File Upload Security
Allowing users to upload introduces security risks. Malicious files can be disguised as legitimate uploads and potentially expose sensitive information.
It’s important to make sure they are validated and stored properly. Since malicious could be executed as scripts.
File Validation
In Laravel, you can validate uploaded files using:
This restricts uploads to specific file types and limits their size.
An attacker could easily rename a file to look like a a harmless image or document. Laravel’s validation validates the mimetypes based on it’s content not on simply by looking at the extensions. However, validation reduces the risks but doesn’t guarantee that a file is safe.
File Storage
Laravel also provides an built-in storage system:
By default, the store method generates a unique ID to serve as the filename, removing the risks of unexpected characters or malicious paths. Unless configured otherwise, this command will save the file on a secure private location.
Dependency Vulnerabilities
When using third-party packages in your application, it’s essential to keep security in mind. Verify if the package comes from a trusted source and is actively maintained.
Recent supply-chain attacks targeting the Composer package manager highlight the importance of evaluating before installing or updating even more.
Do I Need This?
The first thing you could ask yourself is, do I need this?
Adding a dependency for a small convenience isn’t always the smart choice. Reducing your dependencies reduces your attack surface and makes future upgrades easier.
Composer Audit
Composer comes with an built-in security auditing tool, and can easily be run using:
It checks your dependencies for known security vulnerabilities and can report abandoned packages. A smart practice would be to run this before every deployment.
Composer Update
This is a handy command to update all your dependencies at once, but increases exposure to unexpected package changes.
A safer approach is to update specific packages or define version constraints in your composer.json file. When deploying to production, use:
This installs the exact dependency versions recorded in composer.lock , excluding development dependencies and optimizing the autoloader.
Conclusion
There’s a lot more to discover when it comes to web security, but in this series, I’ve tried to cover some of the fundamentals of building secure applications. Hopefully, these articles have provided some practical insights. I’ve gained an even greater understanding of the importance of web security.
