Try It Yourself - SyntaxStudy Editor

HTML / CSS / JS

<?php
// A09: Security Logging — structured log for authentication events

use Illuminate\Support\Facades\Log;

class AuthController extends Controller
{
    public function login(Request $request): JsonResponse
    {
        $ip       = $request->ip();
        $username = $request->input('username');

if (!Auth::attempt($request->only('username', 'password'))) {
            // Log failure with structured context — ingest into SIEM
            Log::warning('authentication.failed', [
                'username'   => $username,
                'ip'         => $ip,
                'user_agent' => $request->userAgent(),
                'timestamp'  => now()->toIso8601String(),
            ]);
            return response()->json(['error' => 'Invalid credentials'], 401);
        }

Log::info('authentication.success', [
            'user_id'    => Auth::id(),
            'ip'         => $ip,
            'user_agent' => $request->userAgent(),
        ]);

return response()->json(['token' => Auth::user()->createToken('api')->plainTextToken]);
    }
}

// A10: SSRF — validate URLs before making server-side requests
function safeFetch(string $url): string
{
    $parsed = parse_url($url);
    if (!$parsed || !in_array($parsed['scheme'] ?? '', ['http', 'https'])) {
        throw new \InvalidArgumentException('Only HTTP/HTTPS URLs are allowed.');
    }
    $host = $parsed['host'] ?? '';
    // Block private/loopback/link-local addresses
    $ip = gethostbyname($host);
    if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) {
        throw new \InvalidArgumentException("Requests to private addresses are forbidden: {$ip}");
    }
    // Block AWS metadata endpoint specifically
    if ($ip === '169.254.169.254') {
        throw new \InvalidArgumentException('Access to metadata endpoint is forbidden.');
    }
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_TIMEOUT, 10);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false); // don't follow redirects
    $result = curl_exec($ch);
    curl_close($ch);
    return $result;
}