• app/Http/Middleware/HandleInertiaRequests.php

  exists

• resources/js/

  contains

  .tsx

  or

  .jsx

  files

• inertiajs/inertia-laravel

  in

  composer.json

• @inertiajs/react

  in

  package.json

"React + Inertia.js detected — Laravel OWASP checklist AND React/Inertia security checks will both be applied."

"No React/Inertia.js detected — applying Laravel OWASP checklist only."

• If arguments provided (

  $ARGUMENTS

  ): review only those files or features
• If no arguments: review the entire codebase

• PASS — brief confirmation of what was verified
• FAIL — exact

  file:line

  , a description of the vulnerability (do NOT reproduce any code, values, API keys, tokens, or .env contents from the file), and a fix recommendation
• N/A — if the check does not apply to this project

• Middleware protects all route groups by role (

  auth

  ,

  role:admin

  , etc.)
• Resource queries scoped to authenticated user —

  ->where('user_id', auth()->id())

• No direct object reference without ownership check
• Gates and Policies used to authorize resource access
• Frontend role checks are mirrored server-side — never rely on React UI checks alone

• Passwords hashed with

  Hash::make()

  or

  'hashed'

  Eloquent cast — never stored as plaintext
• No MD5 or SHA1 used for password hashing
• Sensitive fields (API keys, secrets) encrypted with

  Crypt::encryptString()

  or

  'encrypted'

  Eloquent cast

• APP_KEY

  is long, random, and unique per environment
• Signed URLs (

  URL::signedRoute()

  ) used for sensitive one-time actions (password reset, email verify)

• No string concatenation in

  whereRaw()

  ,

  selectRaw()

  ,

  orderByRaw()

  — use

  ?

  bindings
• Column names never derived from user input without a whitelist
• No

  $request->all()

  passed directly to

  create()

  ,

  fill()

  , or

  update()

• No

  forceFill()

  or

  forceCreate()

  with unvalidated user input
• Models define

  $fillable

  explicitly — not

  $guarded = []

• Controllers use

  $request->validated()

  for mass operations

• No

  {!! $userInput !!}

  in Blade templates with untrusted data

• {{ }}

  used for all user-supplied Blade output
• No

  dangerouslySetInnerHTML

  in React without

  DOMPurify.sanitize()

  first

• href

  and

  src

  attributes not set from unvalidated user input
• No

  eval()

  ,

  new Function()

  , or

  setTimeout(string)

  with user-controlled strings
• External CDN scripts use Subresource Integrity (

  integrity="sha384-..."

  )

• Business logic enforced server-side — prices, totals, and discounts never trusted from client input
• Sensitive operations require secondary confirmation (e.g. password re-entry for account deletion)
• No mass action endpoints without per-item authorization check
• Admin-only features isolated behind separate middleware — not just hidden in the UI
• Payment amounts and enrollment states calculated server-side, not passed as form inputs

• APP_DEBUG=false

  in production

• .env

  is in

  .gitignore

  and never committed
• Database uses a restricted user — not root/admin — in production

• storage/

  and

  bootstrap/cache/

  have correct permissions (not world-writable)

• APP_KEY

  is set and unique per environment
• CORS

  allowed_origins

  is not

  ['*']

  for authenticated API routes

• composer audit

  passes with no known CVEs

• npm audit

  passes with no known CVEs
• Laravel framework is on a supported version

• Using Laravel Breeze, Fortify, or Jetstream — not custom-rolled auth
• Passwords hashed with bcrypt or argon2 (Laravel default)
• Login route rate limited —

  throttle

  middleware or

  RateLimiter

  in

  LoginRequest

• Password reset and email verification routes rate limited
• Payment and sensitive action routes have appropriate rate limits

• session()->regenerate()

  called after successful login

• http_only = true

  in

  config/session.php

• same_site = lax

  or

  strict

  in

  config/session.php

• secure = true

  or

  null

  (auto for HTTPS) in

  config/session.php

• lifetime

  is a reasonable value (15–30 min recommended for most apps)

• domain = null

  unless subdomains are needed

• EncryptCookies

  middleware is in the web group

• VerifyCsrfToken

  middleware active in the web group
• Only stateless routes (webhooks, external callbacks) are excluded from CSRF

• @csrf

  directive used in all non-Inertia POST forms
• Excluded routes in

  validateCsrfTokens(except: [...])

  are justified

• No

  unserialize($request->input(...))

• No

  eval($request->input(...))

• No

  extract($request->all())

• Failed login attempts logged with IP and identifier
• Payment failures and exceptions logged
• Log entries do not contain raw passwords or secrets
• Monitoring in place (Laravel Telescope, Sentry, or similar)

• No

  Http::get($request->input('url'))

  with unvalidated URLs
• User-supplied URLs validated against an allowlist or scheme check
• Internal network addresses blocked from user-supplied URLs

Not part of the OWASP Top 10 but critical for Laravel applications.

• No

  exec()

  ,

  shell_exec()

  ,

  system()

  ,

  passthru()

  with user input
• No open redirects — no

  redirect($request->input('url'))

  with unvalidated URLs
• File uploads validate

  mimes:

  ,

  max:

  — filenames never derived from raw user input

• Content-Security-Policy

  set — with nonces (

  Vite::useCspNonce()

  ) if possible

• X-Frame-Options

  set

• X-Content-Type-Options

  set

• Strict-Transport-Security

  set for HTTPS

• Referrer-Policy

  set

• Permissions-Policy

  set

Only run if React + Inertia.js detected in Step 1.

• No

  dangerouslySetInnerHTML={{ __html: userInput }}

  without

  DOMPurify.sanitize()

  first

• href

  and

  src

  attributes not set from unvalidated user input —

  javascript:

  URLs execute scripts
• No

  eval()

  ,

  new Function()

  , or

  setTimeout(string)

  with user-controlled strings
• Links from user input validate scheme (

  https://

  or

  http://

  only)

• HandleInertiaRequests::share()

  does NOT expose passwords, tokens, or internal-only flags
• Controllers use

  ->only([...])

  or API Resources — not raw model

  toArray()

• All Inertia props are treated as public — visible in

  data-page

  HTML attribute on initial load
• Payment secret keys and admin-only credentials are never passed as Inertia props
• Inertia v2 History Encryption enabled for pages with sensitive data

• Inertia

  X-XSRF-TOKEN

  header not disabled
• Custom

  fetch

  or

  axios

  calls include CSRF token manually if bypassing Inertia's router
• Webhook/callback routes are the ONLY CSRF-excluded routes

• auth.user

  Inertia prop excludes password hash, remember tokens, and 2FA secrets
• Role/permission checks enforced server-side — React checks are UI-only

• auth.user

  contains only fields the UI actually needs

• No API keys or secrets hardcoded in React components or TypeScript files
• No sensitive data in

  localStorage

  or

  sessionStorage

  — use HttpOnly cookies

• VITE_*

  env vars contain no secrets — they are public by design

• npm audit

  passes with no high/critical CVEs in React or Inertia packages
• React is on a supported version
• Third-party component libraries reviewed for known CVEs

React + Inertia.js detected — Laravel OWASP checklist AND React/Inertia security checks will both be applied.

• PASS

  app/Http/Middleware/RoleMiddleware.php

  — role middleware applied to all route groups
• FAIL

  app/Http/Controllers/PaymentController.php:42

  — Payment model fetched without ownership check (direct object reference exposure). Fix: scope the query to the authenticated user.

1. ...

1. ...

• Implementing authentication or password handling
• Building payment or webhook integrations
• Writing file upload or download logic
• Designing admin or role-based access control
• Building API endpoints with user-supplied input
• Using

  dangerouslySetInnerHTML

  in React components
• Passing data from Laravel controllers to Inertia props

• sec-broken-access-control

  — Middleware, ownership checks, policies, scoped queries

• sec-cryptographic-failures

  — Password hashing, encrypted casts, signed URLs

• sec-injection-prevention

  — SQL injection, mass assignment, raw query bindings

• sec-xss-react-inertia

  — dangerouslySetInnerHTML, DOMPurify, href/src validation

• sec-csrf-protection

  — VerifyCsrfToken, webhook exclusions, Inertia CSRF

• sec-security-misconfiguration

  — APP_DEBUG, APP_KEY, security headers, CORS

• sec-authentication-rate-limiting

  — Throttle, session regeneration, brute force prevention

• sec-inertia-data-exposure

  — data-page attribute exposure, secret props, API Resources

rules/sec-broken-access-control.md
rules/sec-cryptographic-failures.md
rules/sec-injection-prevention.md
rules/sec-xss-react-inertia.md
rules/sec-csrf-protection.md
rules/sec-security-misconfiguration.md
rules/sec-authentication-rate-limiting.md
rules/sec-inertia-data-exposure.md

• YAML frontmatter with metadata (title, impact, tags)
• Why it matters in Laravel/React context
• Incorrect code example with explanation
• Correct code example with fix
• Laravel 13 and PHP 8.3+ specific context