While the security of web applications has remained an important aspect in software development, the issue has attained paramount significance because of higher business stakes and investments into the applications, and a security vulnerability can really put a dent on the reputation of the company and its ability to do business.
In this Course, I will talk about Laravel validation and how you can sanitize form inputs to prevent Laravel XSS exploits from harming your Laravel applications.
Input sanitization is a security protocol for checking, filtering, and cleaning data inputs from app users. Input data travels via GET requests, POST requests, and cookies, which hackers can modify, manipulate, and edit to gain access to the server that the web app is hosted on.
Input sanitization is not perfect and the only option to fight different malicious attacks. But it has advantages such as:
Providing a perimeter defense against common cyberattacks
Preventing remote file inclusion and injection attacks
Protecting the system from malicious code
Safeguarding the web server, database, and other digital assets
Laravel Sanitization
Sanitization of input includes the techniques to identify and remove the possible input entries of strings that can be harmful to your application.
Best Practices for XSS Protection in a Laravel Application
Here are some key takeaways for the best application of this procedure.
Add layers of protection. Redundancy improves security. By adding more layers, you give yourself more chances to catch malicious input that might slip through initial security.
Do not overlook client-side validation. This tutorial was focused on backend validation, but you could easily add a new layer of front-end protection using HTML/JavaScript. For example, I can limit the input length through HTML
XSS attacks may be conducted without using <script>...</script> tags. Other tags will do exactly the same thing, for example: <body onload=alert('test1')> or other attributes like: onmouseover, onerror.
onmouseover
<b onmouseover=alert('Wufff!')>click me!</b>
onerror
<img src="http://url.to.file.which/not.exist" onerror=alert(document.cookie);>
XSS Using Script Via Encoded URI Schemes
If we need to hide against web application filters we may try to encode string characters, e.g.: a=&\#X41 (UTF-8) and use it in IMG tags:
<IMG SRC=jAvascript:alert('test2')>
There are many different UTF-8 encoding notations that give us even more possibilities.
XSS Using Code Encoding
We may encode our script in base64 and place it in META tag.
