LARAVEL Risk Assessment & Management 4

Question 1

What risk does Laravel's default session driver 'file' pose in a multi-server deployment?

Accepted Answer

Sessions stored on one server are unavailable on others, causing authentication failures and potential session hijacking via predictable paths

Answer

File-based sessions are local to each server, so load-balanced users lose their session — and predictable file paths can be exploited if file permissions are wrong.

Question 2

How does Laravel's `can` middleware help manage authorization risk on routes?

Accepted Answer

It checks a Gate policy before allowing access, returning 403 if the user lacks permission

Answer

The can middleware invokes a named Gate ability or Policy method, aborting with 403 if authorization fails before the controller runs.

Question 3

Which risk does storing Laravel queue jobs in a database driver (instead of Redis) introduce at scale?

Accepted Answer

High job volume creates database table contention, potentially impacting application performance

Answer

Under heavy load, frequent reads/writes to the jobs table can lock rows and starve the main application database.

Question 4

What is the risk of committing the `storage/` directory to a Git repository in a Laravel project?

Accepted Answer

It may expose log files, user uploads, cached data, and session files containing sensitive information

Answer

The storage directory can contain application logs, user-uploaded files, and serialized session data — all potentially sensitive.

Question 5

A Laravel app deserializes untrusted data using PHP's unserialize(). What critical risk does this introduce?

Accepted Answer

Remote code execution via PHP object injection attacks

Answer

PHP's unserialize() can instantiate arbitrary classes with magic methods (__destruct, __wakeup), enabling code execution if gadget chains exist.

LARAVEL - Laravel PHP Framework Practice Test

LARAVEL - Laravel PHP Framework Practice Test

LARAVEL Risk Assessment & Management 4