This page needs a newer browser to run its tools. You can still read everything here.

Building Web Apps with Laravel Module 13

Security in depth interview questions

Interview questions on security in depth: short warm-ups, then what each harder question tests, the first step of a good answer and its follow-ups.

12 questions: 4 warm-ups and 8 with model answers · Levels: Fresher to staff

Warm-up questions

Short questions with short answers, each answered in full.

Fresher

Which HTTP methods skip the request-forgery check, and why?

Answered in the lesson Laravel's security model and hardening
Fresher to mid

What does a fresh Laravel project protect you from without any code of yours?

Answered in the lesson Laravel's security model and hardening
Fresher to mid

A model can declare $fillable or $guarded. Which one is safer, and why?

Answered in the lesson Common Laravel vulnerabilities: a lab
Fresher

Why are passwords hashed rather than encrypted?

Answered in the lesson Encryption, secrets and key rotation

Questions with model answers

What each question tests, the first step of a good answer and the follow-ups to expect.

Mid to senior

Pathshala goes live next week on one application server behind a load balancer. List, in order, the configuration and code changes that harden a fresh Laravel 13 project for that launch, and say how you would prove each one in CI.
What it tests

Turning what Laravel leaves to you into an ordered checklist, with exact settings, and backing every item with a check that fails before the change.

First step

Split the list into what the framework already does and what it leaves to you. Take the second half in the order an incident would expose it: debug and environment, response headers, cookies and HTTPS, trusted proxies and hosts, then dependencies.
Follow-ups
- Why must trusted proxies be set up before you rely on HTTPS behind the load balancer?
- How would a CI job fail the deploy when a security header is missing?
- What does php artisan config:cache change about when an .env edit takes effect?
From the lesson Laravel's security model and hardening
Model answer, Pro. Model answers open with any pass; prices are in the notice on this page.
Opening the model answers with your pass…
Model answers open with any MySmartCoPilot pass.
Pro pass · 1 week₹79$2.99
30 days₹179$5.99
1 year₹1,699$45
One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.
Passes can’t be bought right now, so the model answers can’t be opened at the moment. If you have a pass, enter your licence key.
Choose a pass I have a licence key
It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
Mid to senior

A colleague wants to switch Pathshala's web routes to origin-only request-forgery checks and drop tokens from the forms. Explain what changes for current browsers, for an older mobile app that posts with a token, and for the feature tests, then make the call.
What it tests

Reading how Laravel 13 decides a state-changing request, predicting which clients break under origin-only mode, and choosing a safe default.

First step

List every client that posts to the web routes and what each one sends. A current browser on HTTPS sends Sec-Fetch-Site; a native app or a script may send only the token. Hold that list against the two modes.
Follow-ups
- Why does a same-site request not pass by default, and when would you allow it?
- Why does a feature test that posts without any token still get a 200?
- Where does a browser leave out Sec-Fetch-Site, and what does that mean for a staging server?
From the lesson Laravel's security model and hardening
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

You inherit a Laravel app with 40 models. Several declare $guarded = [], and many controllers call create($request->all()). Plan an audit that finds every mass-assignment risk, the fix for each, and a change that stops the risk from coming back.
What it tests

Finding mass-assignment risks systematically, fixing them with allowlists and validated data, and adding checks that keep the fix in place.

First step

Search for both halves of the flaw separately: models that leave columns open to filling, and calls that hand a whole request array to create, update, fill or forceFill. The risk lives where the two meet, so list those places first.
Follow-ups
- What does Model::preventSilentlyDiscardingAttributes() change, and where would you turn it on?
- Why is forceFill() with request data worse than an empty guard?
- How would a test prove that a field such as is_admin is never written from a form?
From the lesson Common Laravel vulnerabilities: a lab
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to staff

Pathshala serves 30 coaching centres from one database. A staff member of centre 4 opens /notes/912 and sees a note that belongs to centre 9. Explain the cause, the fix you ship today, and how you stop this whole class of bug.
What it tests

Recognising an insecure direct object reference, fixing it with a scoped query or a policy, and designing centre scoping so that a forgotten check fails closed.

First step

Reproduce it in a feature test before touching the code: two centres with one note each, and a staff user of one centre asking for the other centre's note. Then find the lookup that trusts the id alone.
Follow-ups
- Why is answering 404 rather than 403 a reasonable choice here?
- What does a global scope on the model buy you, and what can still go around it?
- How would you find every other route with the same flaw?
From the lesson Common Laravel vulnerabilities: a lab
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Senior to staff

Pathshala's production APP_KEY was pasted into a public chat by mistake. Explain what someone holding it could do, what the Laravel 13 session and cache settings change about that, and what you do in the first hour.
What it tests

Knowing what the application key encrypts and signs, how the serialization defaults limit a leak, and rotating a leaked key without leaving it usable.

First step

Treat it as an incident. List what the key protects, check the app's session and cache settings, and then plan the rotation: which stored data must still be read with the old key, and which requests must stop trusting it at once.
Follow-ups
- Why does changing the key sign users out, and how does APP_PREVIOUS_KEYS normally avoid it?
- When must the old key stay out of APP_PREVIOUS_KEYS?
- Which stored data encrypted with the old key needs re-encrypting, and how?
From the lesson Common Laravel vulnerabilities: a lab
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
Fresher to mid

Pathshala stores guardians' passwords, their bank account numbers for refunds, a partner's API token that it must send on every call, and fee receipt links mailed to guardians. For each, say whether you hash, encrypt or sign it, how Laravel does it, and what goes wrong with the other two choices.
What it tests

Choosing between hashing, encryption and signing by what must be read back or trusted, naming the Laravel tool for each, and the failure of each wrong choice.

First step

Ask one question of every field: does the app ever need the original value back, only to check it, or only to trust that it is unchanged? The answer picks the tool; then name the Laravel call.
Follow-ups
- Why is the partner's API token encrypted, when the tokens your own API issues are hashed?
- What does a signed receipt link still give away, and how would you limit it?
- When would you add a keyed hash beside an encrypted column?
From the lesson Encryption, secrets and key rotation
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
Mid to senior

Pathshala's policy asks for a new APP_KEY every year. The guardians table holds 600,000 bank account numbers in an encrypted column, and remember-me sign-ins last 400 days. Plan the rotation so that nobody is signed out and no value becomes unreadable, and say how you would know each step worked.
What it tests

Planning an APP_KEY rotation with APP_PREVIOUS_KEYS, re-encrypting stored rows in resumable chunks, and knowing what still depends on the old key before it is dropped.

First step

List everything sealed with the current key: cookies and sessions, encrypted columns, encrypted queued jobs and signed links already sent. Each needs either the old key kept for reading or a rewrite, and the plan orders those two things.
Follow-ups
- Why must the deploy run config:cache again after the .env change?
- What happens to a guardian who last visited 300 days ago when the old key is finally dropped?
- How do you make the re-encryption command safe to stop and start again?
From the lesson Encryption, secrets and key rotation
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
Mid to senior

A teammate proposes committing .env.production to the private repository so that deploys stop failing on missing variables. Say what you would do instead, how the deploy gets its secrets, and how you would find a missing variable before production does.
What it tests

Keeping secrets out of the repository with env:encrypt or a secret store, wiring the key into the deploy, and catching a missing variable early.

First step

Separate the two problems: secrets must not be in git, and a deploy must not start with a variable missing. Choose where the secrets live first, then add a check that fails the deploy when a required value is absent.
Follow-ups
- Where does LARAVEL_ENV_ENCRYPTION_KEY live, and who can read it?
- Why does --readable make reviews easier, and what does it still reveal?
- What do you do when the key of the encrypted file may have leaked?
From the lesson Encryption, secrets and key rotation
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes

All Building Web Apps with Laravel interview questions · The Building Web Apps with Laravel track

Your country

Security in depth interview questions

Warm-up questions

Which HTTP methods skip the request-forgery check, and why?

What does a fresh Laravel project protect you from without any code of yours?

A model can declare `$fillable` or `$guarded`. Which one is safer, and why?

Why are passwords hashed rather than encrypted?

Questions with model answers

Pathshala goes live next week on one application server behind a load balancer. List, in order, the configuration and code changes that harden a fresh Laravel 13 project for that launch, and say how you would prove each one in CI.

A colleague wants to switch Pathshala's web routes to origin-only request-forgery checks and drop tokens from the forms. Explain what changes for current browsers, for an older mobile app that posts with a token, and for the feature tests, then make the call.

You inherit a Laravel app with 40 models. Several declare `$guarded = []`, and many controllers call `create($request->all())`. Plan an audit that finds every mass-assignment risk, the fix for each, and a change that stops the risk from coming back.

Pathshala serves 30 coaching centres from one database. A staff member of centre 4 opens `/notes/912` and sees a note that belongs to centre 9. Explain the cause, the fix you ship today, and how you stop this whole class of bug.

Pathshala's production APP_KEY was pasted into a public chat by mistake. Explain what someone holding it could do, what the Laravel 13 session and cache settings change about that, and what you do in the first hour.

Pathshala stores guardians' passwords, their bank account numbers for refunds, a partner's API token that it must send on every call, and fee receipt links mailed to guardians. For each, say whether you hash, encrypt or sign it, how Laravel does it, and what goes wrong with the other two choices.

Pathshala's policy asks for a new APP_KEY every year. The guardians table holds 600,000 bank account numbers in an encrypted column, and remember-me sign-ins last 400 days. Plan the rotation so that nobody is signed out and no value becomes unreadable, and say how you would know each step worked.

A teammate proposes committing .env.production to the private repository so that deploys stop failing on missing variables. Say what you would do instead, how the deploy gets its secrets, and how you would find a missing variable before production does.

Warm-up questions

Which HTTP methods skip the request-forgery check, and why?

What does a fresh Laravel project protect you from without any code of yours?

A model can declare $fillable or $guarded. Which one is safer, and why?

Why are passwords hashed rather than encrypted?

Questions with model answers

Pathshala goes live next week on one application server behind a load balancer. List, in order, the configuration and code changes that harden a fresh Laravel 13 project for that launch, and say how you would prove each one in CI.

A colleague wants to switch Pathshala's web routes to origin-only request-forgery checks and drop tokens from the forms. Explain what changes for current browsers, for an older mobile app that posts with a token, and for the feature tests, then make the call.

You inherit a Laravel app with 40 models. Several declare $guarded = [], and many controllers call create($request->all()). Plan an audit that finds every mass-assignment risk, the fix for each, and a change that stops the risk from coming back.

Pathshala serves 30 coaching centres from one database. A staff member of centre 4 opens /notes/912 and sees a note that belongs to centre 9. Explain the cause, the fix you ship today, and how you stop this whole class of bug.

Pathshala's production APP_KEY was pasted into a public chat by mistake. Explain what someone holding it could do, what the Laravel 13 session and cache settings change about that, and what you do in the first hour.

Pathshala stores guardians' passwords, their bank account numbers for refunds, a partner's API token that it must send on every call, and fee receipt links mailed to guardians. For each, say whether you hash, encrypt or sign it, how Laravel does it, and what goes wrong with the other two choices.

Pathshala's policy asks for a new APP_KEY every year. The guardians table holds 600,000 bank account numbers in an encrypted column, and remember-me sign-ins last 400 days. Plan the rotation so that nobody is signed out and no value becomes unreadable, and say how you would know each step worked.

A teammate proposes committing .env.production to the private repository so that deploys stop failing on missing variables. Say what you would do instead, how the deploy gets its secrets, and how you would find a missing variable before production does.

A model can declare `$fillable` or `$guarded`. Which one is safer, and why?

You inherit a Laravel app with 40 models. Several declare `$guarded = []`, and many controllers call `create($request->all())`. Plan an audit that finds every mass-assignment risk, the fix for each, and a change that stops the risk from coming back.

Pathshala serves 30 coaching centres from one database. A staff member of centre 4 opens `/notes/912` and sees a note that belongs to centre 9. Explain the cause, the fix you ship today, and how you stop this whole class of bug.