Security

Security features untuk TAVP.

CSRF Protection

// Middleware
\Tavp\Middleware\ValidateCsrfToken::class

// In forms
{{ csrf_field() }}

Password Hashing

// Hash
$hashed = password_hash($password, PASSWORD_BCRYPT);

// Verify
if (password_verify($password, $hashed)) {
    // correct
}

XSS Prevention

{{ user.name }}
{{ user.content | raw }}

SQL Injection Prevention

// Use parameterized queries
$users = DB::select('SELECT * FROM users WHERE email = ?', [$email]);

// Use ORM (safe by default)
$user = User::where('email', $email)->first();

Rate Limiting

$router->post('/api/auth/login', [
    'middleware' => 'throttle:5,1',
    'uses' => 'AuthController@login',
]);

Security Headers

'X-Content-Type-Options' => 'nosniff',
'X-Frame-Options' => 'DENY',
'X-XSS-Protection' => '1; mode=block',

Link

• Reference