Question 1

How does CSRF protection work in Laravel, what causes a 419 Page Expired error, and how do you fix it?

Accepted Answer

Laravel generates a unique CSRF token per session and checks it on every POST/PUT/DELETE request; status 419 means the session expired or the form did not include the token.

Question 2

What is Mass Assignment, and how do $fillable and $guarded differ in Eloquent?

Accepted Answer

It occurs when a developer passes $request->all() directly to create(), allowing users to change sensitive fields such as is_admin; $fillable prevents this by restricting updates to an allowlist.

Question 3

How does Laravel hash passwords with the Hash Facade?

Accepted Answer

By default, it uses bcrypt (or Argon2), adds a Salt, and creates secure, slow hashes with Hash::make(); verify them with Hash::check().

Question 4

How do Gates and Policies differ in Laravel authorization?

Accepted Answer

Gates are defined for general actions unrelated to a specific model (such as accessing an admin dashboard), while Policies organize permissions around a model (such as PostPolicy).

Question 5

How do Eloquent and Query Builder protect Laravel applications from SQL Injection?

Accepted Answer

Standard methods such as where and find automatically use PDO Prepared Statements, treating user input as values rather than executable code.

Question 6

How does Blade protect against XSS, and what is the difference between {{ $data }} and {!! $data !!}?

Accepted Answer

{{ $data }} automatically passes text through htmlspecialchars() to prevent malicious scripts from running, while {!! $data !!} outputs raw text without protection.

Question 7

What are the strict security rules for uploading and storing files in Laravel?

Accepted Answer

Verify the actual MIME type, block executable extensions (.php, .sh), generate random filenames, and store files outside the public directory or in S3.

Question 8

What is the role of APP_KEY in Laravel, and what are the risks of changing or exposing it in production?

Accepted Answer

It is the primary encryption key (AES-256) for cookies, sessions, and encrypted fields; exposing it allows data to be decrypted or forged, while changing it prevents old data from being decrypted.

Question 9

What are Signed URLs in Laravel, and when are they used to protect sensitive operations?

Accepted Answer

They contain a digital signature (HMAC Hash) that prevents parameter tampering and can have an expiration time; use them for email verification and account recovery.

Question 10

How do you implement a Content Security Policy with a Nonce in Laravel applications?

Accepted Answer

Generate a unique random Nonce for each HTTP request, include it in the CSP header and in <script nonce="..."> tags to block injected scripts.