OhMySkills
语言与基础运行时 php-laravel-security 更新于 2026-07-31

PHP · 安全规则

Security rules for PHP: boundary validation, server-side authorisation and zero secret leakage.

技术栈
PHP
主题
安全
条目
9 条
版本
v0.2.0

✓ 应当这么做

  • ✓ Validate and normalise every input at the boundary it enters the system
  • ✓ Authorise on the server against the authenticated principal, never on client claims
  • ✓ Keep secrets out of repositories, logs and error messages

✕ 常见反模式

  • ✕ Trusting headers or parameters that a client can set freely
  • ✕ Disabling TLS verification or CSRF protection to unblock a test
  • ✕ Wide-scope tokens with no expiry

◎ 交付前验证

  • ◎ Static analysis (PHPStan/Psalm) passes on the changed module
  • ◎ Feature tests cover the new endpoint
  • ◎ Migrations are reversible

同分类条目

32 篇

同一技术栈的其他条目