security-hardening

name	security-hardening
description	Security patterns and hardening practices for this monorepo. Use when implementing authentication, configuring CORS, validating input, handling secrets, securing API endpoints, or reviewing code for vulnerabilities. Triggers on tasks involving security, auth guards, env validation, CORS, CSP, rate limiting, or OWASP compliance.
frameworks	["laravel","nextjs","sanctum","zod"]
languages	["php","typescript"]
category	security
updated	"2026-04-29T00:00:00.000Z"

Security Hardening

Quick Reference

Layer	Mechanism	Location
Input validation	Laravel Form Requests	apps/laravel/app/Http/Requests/
API auth	Laravel Sanctum (cookie + PAT)	apps/laravel/ — auth:sanctum middleware
CORS	Origin whitelist from env	apps/laravel/config/cors.php + CORS_ALLOWED_ORIGINS
Env validation	@t3-oss/env-nextjs	apps/web/env.ts
Error masking	Laravel exception handler	apps/laravel/app/Exceptions/Handler.php
Security groups	ALB → EC2 ASG only	Managed in turbo-infrastructure repo

Environment Validation (Fail-Fast)

Laravel (apps/laravel/.env validated via config/)

Laravel validates environment variables at boot time via its config system. Required variables must be set or the app will throw:

// config/sanctum.php — SANCTUM_STATEFUL_DOMAINS must be set in production
'stateful' => explode(',', env('SANCTUM_STATEFUL_DOMAINS', '')),

Use php artisan config:cache to bake config values and surface missing vars at deploy time.

Web (apps/web/env.ts)

import { createEnv } from "@t3-oss/env-nextjs"
import { z } from "zod"

export const env = createEnv({
	client: {
		NEXT_PUBLIC_APP_URL: z.string().url(),
		NEXT_PUBLIC_API_BASE_URL: z.string().url(),
		NEXT_PUBLIC_API_VERSION: z.string().default("v1"),
	},
	runtimeEnv: {
		NEXT_PUBLIC_APP_URL: process.env.NEXT_PUBLIC_APP_URL,
		NEXT_PUBLIC_API_BASE_URL: process.env.NEXT_PUBLIC_API_BASE_URL,
		NEXT_PUBLIC_API_VERSION: process.env.NEXT_PUBLIC_API_VERSION,
	},
})

Rules:

• Backend validates at runtime startup — crash immediately if vars missing
• Web validates at build time — fail the build if vars missing
• skipValidation in CI/lint prevents false failures during linting
• Always validate with Zod schemas (.url(), .string(), .enum())

CORS Configuration

// config/cors.php — origins from CORS_ALLOWED_ORIGINS env var
return [
    'paths' => ['api/*', 'sanctum/csrf-cookie'],
    'allowed_origins' => explode(',', env('CORS_ALLOWED_ORIGINS', '')),
    'allowed_methods' => ['*'],
    'allowed_headers' => ['*'],
    'exposed_headers' => [],
    'max_age' => 0,
    'supports_credentials' => true, // Required for Sanctum cookie auth
];

Rules:

• Never set allowed_origins to ['*'] — always whitelist specific origins
• supports_credentials: true is required for Sanctum cookie-based auth to work cross-origin
• Origins come from environment variables (CORS_ALLOWED_ORIGINS), not hardcoded

Authentication Security

Cookie-Based Sessions (Web)

Laravel Sanctum uses encrypted session cookies for SPA authentication:

// Route protection — use auth:sanctum middleware
Route::middleware('auth:sanctum')->group(function () {
    Route::apiResource('todos', TodoController::class);
});

// In controllers — always use Auth facade, never trust client-sent IDs
public function store(StoreTodoRequest $request): TodoResource
{
    $todo = $request->user()->todos()->create($request->validated());
    return new TodoResource($todo);
}

Personal Access Tokens (Mobile)

Mobile clients authenticate with PATs issued at login:

// Issue PAT on login
$token = $user->createToken('mobile')->plainTextToken;
return response()->json(['token' => $token, 'token_type' => 'Bearer', 'user' => $user]);

Rules:

• Never accept user_id or created_by from request body — always use $request->user()
• Protect all authenticated routes with auth:sanctum middleware
• SANCTUM_STATEFUL_DOMAINS must match the frontend domain to prevent CSRF issues

Frontend Cookie Forwarding

// Server-side fetch with cookie forwarding
fetch: async (url, init) => {
	return fetch(url, {
		...init,
		headers,
		credentials: "include", // Include cookies in cross-origin requests
		...(isServer
			? {
					cache: "no-store", // Never cache authenticated responses
					next: { revalidate: 0 },
				}
			: {}),
	})
}

Input Validation

Laravel Form Requests

All input validation lives in Form Request classes:

// app/Http/Requests/StoreTodoRequest.php
class StoreTodoRequest extends FormRequest
{
    public function authorize(): bool
    {
        return true; // Auth handled by middleware
    }

    public function rules(): array
    {
        return [
            'title'     => ['required', 'string', 'max:255'],
            'completed' => ['boolean'],
        ];
    }
}

Rules:

• Define validation in Form Requests, not in controllers
• Always set max:255 for string fields; use min:1 for required strings
• Use exists:table,column rules for foreign key integrity
• Use email rule for email fields
• Never trust raw $request->all() — always use $request->validated()

Validation Error Response Format

Laravel returns 422 on validation failure with this shape:

{
    "message": "The title field is required.",
    "errors": {
        "title": ["The title field is required."]
    }
}

Error Masking

Laravel's exception handler ensures internal errors never leak to clients:

// app/Exceptions/Handler.php — APP_DEBUG=false hides stack traces in production
// 404s return JSON via willTerminate or shouldReturnJson()
// 500s return a generic JSON error message

Rules:

• Never expose stack traces in production (APP_DEBUG=false)
• Log full error details via Laravel's logging system (server-side only)
• Return safe messages client-side with appropriate HTTP status codes
• Use abort(403) / abort(404) rather than throwing generic exceptions

Network Security (AWS)

Security Group Rules

ALB SG:
  Inbound: 80 (HTTP), 443 (HTTPS) from 0.0.0.0/0
  Outbound: All

EC2 ASG SG:
  Inbound: 3001, 8000 from ALB SG only
  Outbound: All

RDS / MySQL SG:
  Inbound: 3306 from EC2 ASG SG only
  Outbound: None

Rules:

• EC2 instances should only be reachable via the ALB (SG-to-SG reference)
• Database only accepts connections from EC2 instances (not public)
• Outbound allowed for external API calls and package installs

Secret Management

Environment Variables by Risk Level

Risk	Where	Example
Public	GitHub Variables	NEXT_PUBLIC_APP_URL, AWS_REGION, PROJECT_NAME
Secret	GitHub Secrets	APP_KEY, DATABASE_URL, AWS_SECRET_ACCESS_KEY
Build-time	Docker ARG	NEXT_PUBLIC_API_BASE_URL (baked into JS bundle)
Runtime	EC2 env / Docker env	APP_KEY, DB_PASSWORD, CORS_ALLOWED_ORIGINS

Rules:

• Never commit secrets to .env files (only .env.example with placeholder values)
• Use GitHub Secrets for anything sensitive
• APP_KEY must be a stable secret — rotating it invalidates all sessions and encrypted data
• Rotate secrets regularly, especially AWS_SECRET_ACCESS_KEY

Security Checklist for New Features

1. Input validated via Laravel Form Request
2. Auth required? Route protected with auth:sanctum middleware
3. User ID from $request->user(), not request body
4. CORS allows only expected origins (CORS_ALLOWED_ORIGINS)
5. Error responses don't leak internals (APP_DEBUG=false in production)
6. Secrets in GitHub Secrets, not env files or code
7. Database queries use Eloquent ORM (parameterized by default)
8. No raw SQL with string concatenation — use DB::select() with bindings if needed
9. File uploads validated for type and size
10. Rate limiting considered for public endpoints (throttle: middleware)