What are the strict security rules for uploading and storing files in Laravel?

Short answer

Verify the actual MIME type, block executable extensions (.php, .sh), generate random filenames, and store files outside the public directory or in S3.

Explanation

Allowing an executable PHP file into the site's public directory can give an attacker full server control (Remote Code Execution). Security rules include validating with File::types(['jpg', 'png'])->max(5120), generating a safe random name with $file->hashName(), and storing the file in internal storage behind a symbolic link or uploading it directly to cloud storage.

Code example

$request->validate([
    'avatar' => ['required', 'file', 'image', 'max:2048']
]);
$path = $request->file('avatar')->store('avatars', 'private');

Common mistakes

• Trusting the original filename from $file->getClientOriginalName() when saving a file on the server.

Follow-up questions

• How do you implement a Content Security Policy with a Nonce in Laravel applications?

Sources

• Laravel docs — File Storage