Laravel Security & Pest Testing Guide: Build Bulletproof Apps 2025

In today's threat landscape, security isn't optional—it's fundamental to building trustworthy applications that protect user data and maintain business continuity. Laravel provides robust security features out of the box, but implementing comprehensive security requires understanding best practices, coupled with rigorous testing strategies that ensure your defenses remain effective over time.

This comprehensive guide explores essential security practices for Laravel applications in 2025, introduces the power of Pest for architecture testing, and demonstrates how to build applications that are both secure and thoroughly tested. Whether you're building a small business application or an enterprise-scale system, these practices will help you create resilient, trustworthy software.

The Security Foundation: Laravel's Built-in Protection

Laravel includes several security features that work automatically to protect your applications. Understanding these foundational protections is crucial for building upon them effectively.

CSRF Protection: Defending Against Cross-Site Request Forgery

Laravel's CSRF protection is both automatic and comprehensive. Every web form should include CSRF tokens to prevent unauthorized actions:

<!-- Blade template with CSRF protection -->
<form method="POST" action="{{ route('user.update') }}">
  @csrf @method('PUT')
  <input type="email" name="email" value="{{ old('email', $user->email) }}" required>
  <input type="text" name="name" value="{{ old('name', $user->name) }}" required>
  <button type="submit">Update Profile</button>
</form>

For AJAX requests, include the CSRF token in your requests:

// Alpine.js component with CSRF
protection function profileForm() {
  return {
	form: {
	  email: '',
	  name: ''
	},
	async submit() {
	  const token = document.querySelector('meta[name="csrf-token"]').content;
	  try {
		await fetch('/api/user/profile', {
		  method: 'PUT',
		  headers: {
			'Content-Type': 'application/json',
			'X-CSRF-TOKEN': token
		  },
		  body: JSON.stringify(this.form)
		});
		
		// Handle success
	  } catch (error) {
		// Handle error
	  }
	}
  }
}

SQL Injection Prevention with Eloquent ORM

Laravel's Eloquent ORM uses PDO binding, which automatically protects against SQL injection attacks. However, raw queries require careful parameter binding:

// ✅ Good: Parameterized queries prevent SQL injection
class UserRepository
{
	public function findByEmailAndStatus(string $email, string $status): ?User
	{
		return User::where('email', $email)
			->where('status', $status)
			->first();
	}
		
	public function searchUsers(string $searchTerm): Collection
	{
		// Even complex queries are safe with parameter binding
		return DB::select(' SELECT u.*, p.name as profile_name FROM users u LEFT JOIN profiles p ON u.id = p.user_id WHERE u.name LIKE ? OR u.email LIKE ? ORDER BY u.created_at DESC ', ["%{$searchTerm}%", "%{$searchTerm}%"]);
	}
}

// ❌ Bad: Raw concatenation opens SQL injection vulnerabilities
class VulnerableUserRepository
{
	public function badSearch(string $term): Collection
	{
		// NEVER DO THIS - vulnerable to SQL injection
		return DB::select("SELECT * FROM users WHERE name = '{$term}'");
	}
}

XSS Protection Through Output Escaping

Laravel's Blade templating engine automatically escapes output to prevent XSS attacks:

{{-- Blade automatically escapes output --}}
<h1>Welcome, {{ $user->name }}!</h1>

{{-- Safe: HTML entities escaped --}}
<p>{{ $userContent }}</p> 

{{-- Safe: User input escaped --}}
{{-- Raw output should be used sparingly and only with trusted content --}}
<div class="content">
  {!! $trustedHtmlContent !!} {{-- Use only for trusted, sanitized HTML --}}
</div>

{{-- For JSON data in JavaScript --}}
<script>
  const userData = @json($user);
  // Laravel safely encodes JSON
  const settings = @json($settings);
</script>

Advanced Security Implementations

Multi-Factor Authentication (MFA)

Implementing MFA significantly enhances account security:

// MFA Service Implementation
class MfaService
{
	public function generateSecretKey(User $user): string
	{
		$secretKey = $this->generateRandomSecret();
		$user->update([
			'mfa_secret' => encrypt($secretKey),
			'mfa_enabled' => false, // Enable after verification
		]);

		return $secretKey;
	}
	
	public function generateQrCode(User $user, string $secretKey): string
	{
		$appName = config('app.name');
		$qrCodeUrl = "otpauth://totp/{$appName}:{$user->email}?secret={$secretKey}&issuer={$appName}";
	
		return QrCode::size(200)->generate($qrCodeUrl);
	}

	public function verifyMfaCode(User $user, string $code): bool
	{
		$secretKey = decrypt($user->mfa_secret);
		$timestamp = floor(time() / 30);

		// Check current timestamp and previous/next for clock drift
		for ($i = -1; $i <= 1; $i++) {
			$calculatedCode = $this->generateTotpCode($secretKey, $timestamp + $i);

			if (hash_equals($calculatedCode, $code)) {
		  		return true;
		  	}
		}
		
		return false;
	}
}

// MFA Controller
class MfaController extends Controller
{
	public function setup(MfaService $mfaService): View
	{
		$user = auth()->user();
		$secretKey = $mfaService->generateSecretKey($user);
		$qrCode = $mfaService->generateQrCode($user, $secretKey);

		return view('auth.mfa-setup', compact('qrCode', 'secretKey'));
	}
		 
	public function verify(Request $request, MfaService $mfaService): RedirectResponse
	{
		$request->validate([
			'code' => ['required', 'string', 'size:6'],
		]);
		
		$user = auth()->user();
		  
		if (!$mfaService->verifyMfaCode($user, $request->code)) {
			return back()->withErrors(['code' => 'Invalid verification code.']);
		}
		  
		$user->update(['mfa_enabled' => true]);

		return redirect()->route('dashboard')->with('success', 'MFA enabled successfully!');
	}
}

Rate Limiting and Brute Force Protection

Implement comprehensive rate limiting to prevent abuse:

// Advanced rate limiting configuration
class RateLimitServiceProvider extends ServiceProvider
{
	public function boot(): void
	{
		RateLimiter::for('login', function (Request $request) {
			$key = Str::lower($request->input('email')) . '|' . $request->ip();
			return [
				Limit::perMinute(5)->by($key),
				Limit::perHour(20)->by($key)->response(function () {
					return response()->json([
						'message' => 'Account temporarily locked due to too many failed attempts.', 'retry_after' => 3600
					], 429);
				}),
			];
		});

		RateLimiter::for('api', function (Request $request) {
			return $request->user() ? Limit::perMinute(100)->by($request->user()->id) : Limit::perMinute(20)->by($request->ip());
		});

		RateLimiter::for('password-reset', function (Request $request) {
			return Limit::perHour(3)->by($request->ip());
		});
	}
}

// Login controller with rate limiting
class LoginController extends Controller
{
	public function login(Request $request): JsonResponse
	{
		$request->validate([
			'email' => ['required', 'email'],
			'password' => ['required', 'string'],
		]);

		// Check rate limit before attempting login
		$key = Str::lower($request->input('email')) . '|' . $request->ip();
		$attempts = RateLimiter::attempts('login:' . $key);
		
		if ($attempts >= 5) {
			$seconds = RateLimiter::availableIn('login:' . $key);

			return response()->json([
				'message' => 'Too many login attempts. Try again in ' . ceil($seconds / 60) . ' minutes.',
			], 429);
		}

		if (Auth::attempt($request->only('email', 'password'))) {
			RateLimiter::clear('login:' . $key);
			
			return response()->json(['message' => 'Login successful']);
		}

		RateLimiter::hit('login:' . $key, 300);

		// 5-minute penalty
		return response()->json(['message' => 'Invalid credentials'], 401);
	}
}

Secure File Upload Handling

File uploads present significant security risks that require careful handling:

class SecureFileUploadService
{
	private array $allowedMimeTypes = [
		'image/jpeg',
		'image/png',
		'image/gif',
		'image/webp',
		'application/pdf',
		'text/plain',
		'text/csv'
	];

	private array $allowedExtensions = [
		'jpg', 'jpeg', 'png', 'gif', 'webp', 'pdf', 'txt', 'csv'
	];

	public function validateAndStore(UploadedFile $file, string $directory = 'uploads'): array
	{
		// Validate file size (10MB max)
		if ($file->getSize() > 10485760) {
			throw new ValidationException('File size exceeds 10MB limit.');
		}

		// Validate MIME type
		if (!in_array($file->getMimeType(), $this->allowedMimeTypes)) {
			throw new ValidationException('File type not allowed.');
		} 

		// Validate extension
		$extension = strtolower($file->getClientOriginalExtension());
		
		if (!in_array($extension, $this->allowedExtensions)) {
			throw new ValidationException('File extension not allowed.');
		}

		// Generate secure filename
		$filename = Str::random(32) . '.' . $extension;
		$path = $file->storeAs($directory, $filename, 'private');

		// Scan for malware (if available)
		if (class_exists('ClamAV')) {
			$scanner = new ClamAV();

			if (!$scanner->scan(storage_path("app/{$path}"))) {
				Storage::disk('private')->delete($path);
		
				throw new SecurityException('File failed security scan.');
			}
		}
	
		return [
			'original_name' => $file->getClientOriginalName(),
			'stored_path' => $path,
			'size' => $file->getSize(),
			'mime_type' => $file->getMimeType(),
		];
	}

	public function serveFile(string $path, string $originalName): Response
	{
		$fullPath = storage_path("app/{$path}");

		if (!file_exists($fullPath)) {
			abort(404);
		}

		// Security headers for file serving
		return response()->file($fullPath, [
			'Content-Security-Policy' => 'default-src \'none\'',
			'X-Content-Type-Options' => 'nosniff',
			'X-Frame-Options' => 'DENY',
			'Content-Disposition' => 'attachment; filename="' . $originalName . '"',
		]);
	}
}

Introduction to Pest: Modern PHP Testing

Pest revolutionizes PHP testing with its elegant, expressive syntax built on top of PHPUnit. Let's explore how Pest can transform your testing workflow and improve code quality.

Getting Started with Pest

composer require pestphp/pest-plugin-laravel --dev php artisan pest:install

Basic Test Structure Comparison

// Traditional PHPUnit syntax
class UserTest extends TestCase
{
	public function test_user_can_be_created(): void {
		$userData = [
			'name' => 'John Doe',
			'email' => '[email protected]',
			'password' => 'password123',
		];

		$response = $this->post('/register', $userData);
		$response->assertStatus(201);
		$this->assertDatabaseHas('users', [
			'email' => '[email protected]',
		]);
	}
}

// Pest syntax - clean and expressive
test('user can be created', function () {
	$userData = [
		'name' => 'John Doe',
		'email' => '[email protected]',
		'password' => 'password123',
	];

	$response = $this->post('/register', $userData);

	$response->assertStatus(201);
	expect($userData['email'])->toBeInDatabase('users', 'email');
});

// Even more expressive with Pest's expectations
it('creates a user successfully', function () {
	$user = User::factory()->make();
	$response = $this->post('/register', $user->toArray());

	expect($response)
		->status()->toBe(201)
		->and($user->email)
		->toBeInDatabase('users', 'email');
});

Architecture Testing with Pest

Architecture testing ensures your code follows established patterns and conventions, preventing architectural drift over time.

Basic Architecture Rules

// tests/Architecture/GeneralTest.php
test('models should extend the base Model class')
	->expect('App\Models')
	->toExtend('Illuminate\Database\Eloquent\Model');

test('controllers should extend the base Controller class')
	->expect('App\Http\Controllers')
	->toExtend('App\Http\Controllers\Controller');

test('requests should extend FormRequest')
	->expect('App\Http\Requests')
	->toExtend('Illuminate\Foundation\Http\FormRequest');

test('middleware should implement MiddlewareInterface')
	->expect('App\Http\Middleware')
	->toImplement('Illuminate\Contracts\Http\Middleware');

test('jobs should implement ShouldQueue')
	->expect('App\Jobs')
	->toImplement('Illuminate\Contracts\Queue\ShouldQueue');

Advanced Architecture Testing

// tests/Architecture/SecurityTest.php
test('controllers should not have database queries')
	->expect('App\Http\Controllers')
	->not->toUse([
		'Illuminate\Support\Facades\DB',
		'illuminate\Database\Eloquent\Builder',
	]);

test('models should not use facades')
	->expect('App\Models')
	->not->toUse('Illuminate\Support\Facades');

test('services should not use request facade')
	->expect('App\Services')
	->not->toUse('Illuminate\Http\Request');

test('repositories should use dependency injection')
	->expect('App\Repositories')
	->toHaveConstructor();

// Security-focused architecture tests
test('controllers should validate input')
	->expect('App\Http\Controllers')
	->toUse('Illuminate\Http\Request');

test('sensitive operations should use authorization')
	->expect(['App\Http\Controllers\Admin', 'App\Http\Controllers\User'])
	->toUse([
		'Illuminate\Foundation\Auth\Access\AuthorizesRequests',
		'Illuminate\Support\Facades\Gate'
	]);

Layer Architecture Testing

// tests/Architecture/LayerTest.php
test('controllers should not depend on infrastructure')
	->expect('App\Http\Controllers')
	->not->toUse([
		'App\Infrastructure',
		'Illuminate\Support\Facades\Storage',
		'Illuminate\Support\Facades\Mail',
		'Illuminate\Support\Facades\Queue',
	]);

test('domain layer should be framework agnostic')
	->expect('App\Domain')
	->not->toUse([
		'Illuminate\Http',
		'Illuminate\Database',
		'Illuminate\Support\Facades',
	]);

test('application services should orchestrate domain operations')
	->expect('App\Services')
	->toUse('App\Domain');

test('repositories should implement contracts')
	->expect('App\Repositories')
	->toImplement('App\Contracts');

Comprehensive Security Testing

Testing Authentication and Authorization

// tests/Feature/AuthenticationTest.php
describe('User Authentication', function () {
	it('requires authentication for protected routes', function () {
		$this->get('/dashboard')
			->assertRedirect('/login');
	});

	it('throttles login attempts', function () {
		$user = User::factory()->create();

		// Make 5 failed attempts
		for ($i = 0; $i < 5; $i++) {
			$this->post('/login', [
		  		'email' => $user->email,
		  		'password' => 'wrong-password',
		  	]);
		}

		// 6th attempt should be throttled
		$response = $this->post('/login', [
			'email' => $user->email,
		  	'password' => 'wrong-password',
		]);
		  
		expect($response->status())->toBe(429);
	});
		  
	it('invalidates sessions on logout', function () {
		$user = User::factory()->create();

		$this->actingAs($user)
			->post('/logout')
		  	->assertRedirect('/');
		
		$this->get('/dashboard')
		  	->assertRedirect('/login');
	});
});
		  
// Authorization testing
describe('User Authorization', function () {
	it('prevents users from accessing others data', function () {
		$user1 = User::factory()->create();
		$user2 = User::factory()->create();
		$post = Post::factory()->create(['user_id' => $user2->id]);

		$this->actingAs($user1)
			->get("/posts/{$post->id}/edit")
		  	->assertStatus(403);
	});
	
	it('allows admins to access admin routes', function () {
		$admin = User::factory()->admin()->create();

		$this->actingAs($admin)
			->get('/admin/dashboard')
		  	->assertStatus(200);
	});
});

Testing Input Validation and Sanitization

// tests/Feature/ValidationTest.php
describe('Input Validation', function () {
	it('validates required fields', function () {
		$response = $this->post('/posts', []);

		expect($response)
		  ->status()->toBe(422)
		  ->json('errors')
		  ->toHaveKeys(['title', 'content']);
	});

	it('sanitizes malicious input', function () {
		$maliciousInput = '<script>alert("XSS")</script>';
		$response = $this->post('/posts', [
			'title' => 'Test Post',
			'content' => $maliciousInput,
		]);

		$post = Post::latest()->first();

		expect($post->content)
			->not->toContain('<script>')
			->toContain('<script>');
		});
			  
		it('validates file uploads', function () {
			$file = UploadedFile::fake()->create('malicious.exe', 1000);
		  	$response = $this->post('/upload', [
				'file' => $file,
			]);

		  	expect($response)
				->status()->toBe(422)
			  	->json('errors.file')->toContain('file type is not allowed');
		});
});

Testing CSRF Protection

// tests/Feature/CsrfTest.php
describe('CSRF Protection', function () {
	it('rejects requests without CSRF token', function () {
		$user = User::factory()->create();

		$response = $this->post('/profile', [
			'name' => 'Updated Name',
			'email' => '[email protected]',
		]);

		expect($response->status())->toBe(419); // CSRF token mismatch
	});

	it('accepts requests with valid CSRF token', function () {
		$user = User::factory()->create();

		$response = $this->actingAs($user)
			->from('/profile')
			->post('/profile', [
				'name' => 'Updated Name',
				'email' => '[email protected]',
				'_token' => csrf_token(),
			]);

		expect($response)->status()->toBe(302);
	});
});

Performance and Security Testing Integration

// tests/Feature/PerformanceSecurityTest.php
describe('Performance Security', function () {
	it('prevents timing attacks on login', function () {
		$validUser = User::factory()->create(['email' => '[email protected]']);

		// Time invalid user login
		$start1 = microtime(true);
		$this->post('/login', [
			'email' => '[email protected]',
			'password' => 'password',
		]);
		$time1 = microtime(true) - $start1;

		// Time valid user with wrong password
		$start2 = microtime(true);
		$this->post('/login', [
			'email' => '[email protected]',
			'password' => 'wrongpassword',
		]);

		$time2 = microtime(true) - $start2;

		// Times should be similar (within 10ms) to prevent timing attacks
		expect(abs($time1 - $time2))->toBeLessThan(0.01);
	});

	it('limits database queries to prevent DoS', function () {
		DB::enableQueryLog();
		
		$this->get('/posts?per_page=1000');
		$queries = DB::getQueryLog();

		// Should not execute more than reasonable number of queries
		expect(count($queries))->toBeLessThan(10);
	});

	it('enforces memory limits for large operations', function () {
		$initialMemory = memory_get_usage();
	
		// Perform potentially memory-intensive operation
		$this->post('/bulk-import', [
			'data' => str_repeat('large data chunk', 10000),
		]);

		$memoryUsage = memory_get_usage() - $initialMemory;

		// Should not consume excessive memory (50MB limit)
		expect($memoryUsage)->toBeLessThan(50 * 1024 * 1024);
	});
});

Advanced Testing Patterns

Testing Security Headers

// tests/Feature/SecurityHeadersTest.php
describe('Security Headers', function () {
	it('includes security headers on all responses', function () {
		$response = $this->get('/');

		expect($response->headers->all())
			->toHaveKey('x-frame-options')
			->toHaveKey('x-content-type-options')
			->toHaveKey('x-xss-protection')
			->toHaveKey('strict-transport-security');
	});

	it('sets appropriate CSP headers', function () {
		$response = $this->get('/dashboard');
		$csp = $response->headers->get('content-security-policy');

		expect($csp)
			->toContain("default-src 'self'")
			->toContain("script-src 'self'")
			->not->toContain("'unsafe-eval'");
	});
});

Testing with Datasets

// tests/Feature/ValidationDatasetTest.php
describe('Input Validation with Datasets', function () {
	it('validates email formats', function (string $email, bool $shouldPass) {
		$response = $this->post('/register', [
			'name' => 'Test User',
			'email' => $email,
			'password' => 'password123',
		]);

		if ($shouldPass) {
			expect($response->status())->toBe(201);
		} else {
			expect($response)
				->status()->toBe(422)
				->json('errors')->toHaveKey('email');
		}
  })->with([
	['[email protected]', true],
	['[email protected]', true],
	['invalid.email', false],
	['@domain.com', false],
	['email@', false],
	['<script>alert("xss")</script>@domain.com', false],
  ]);
});

Continuous Security Monitoring

Automated Security Auditing

// tests/Feature/SecurityAuditTest.php
describe('Security Audit', function () {
	it('has no known vulnerable dependencies', function () {
		// Run composer audit and check results
		$auditResult = shell_exec('composer audit --format=json 2>/dev/null');
		$audit = json_decode($auditResult, true);

		expect($audit['vulnerabilities'] ?? [])->toBeEmpty();
	});

	it('uses secure configuration settings', function () {
		expect(config('app.debug'))->toBeFalse();
		expect(config('app.env'))->not->toBe('local');
		expect(config('session.secure'))->toBeTrue();
		expect(config('session.http_only'))->toBeTrue();
	});

	it('has secure file permissions', function () {
		$envPermissions = substr(sprintf('%o', fileperms(base_path('.env'))), -3);
		$storagePermissions = substr(sprintf('%o', fileperms(storage_path())), -3);

		expect($envPermissions)->toBe('600'); // Owner read/write only
		expect($storagePermissions)->toBe('755'); // Standard directory permissions
	});
});

Conclusion

Building secure and testable Laravel applications requires a comprehensive approach that combines Laravel's built-in security features with rigorous testing practices. By implementing proper CSRF protection, input validation, authentication controls, and rate limiting, you create a strong security foundation.

Pest's architecture testing capabilities ensure that security practices remain consistent across your codebase as it evolves. The combination of functional security tests, architecture rules, and continuous monitoring creates a robust defense against security vulnerabilities.

Key takeaways for secure Laravel development in 2025:

Layer security defenses - No single security measure is sufficient
Test security assumptions - Architecture testing prevents security regression
Monitor continuously - Security is an ongoing process, not a one-time setup
Follow the principle of least privilege - Users and systems should have minimal necessary access
Keep dependencies updated - Regular security audits prevent known vulnerabilities

By combining these security practices with comprehensive testing using Pest, you'll build Laravel applications that not only protect user data but also maintain security standards as your codebase grows and evolves. The investment in security and testing pays dividends in reduced vulnerabilities, easier maintenance, and increased user trust.

Remember that security is a moving target—new threats emerge constantly, and your defenses must evolve accordingly. The practices outlined in this guide provide a solid foundation, but staying informed about emerging security threats and Laravel security updates remains essential for maintaining robust application security.

Building Secure and Testable Laravel Applications: A Comprehensive Guide to Security Best Practices and Architecture Testing with Pest