Zero-Trust Architecture in Laravel Applications

// config/fortify.php 'features' => [ Features::registration(), Features::resetPasswords(), Features::emailVerification(), Features::updateProfileInformation(), Features::updatePasswords(), Features::twoFactorAuthentication([ 'confirm' => true, 'confirmPassword' => true, ]), ], 

// app/Models/User.php use Laravel\Fortify\TwoFactorAuthenticatable; class User extends Authenticatable { use TwoFactorAuthenticatable; public function enableTwoFactorAuth() { $this->forceFill([ 'two_factor_secret' => encrypt(app(TwoFactorAuthenticationProvider::class)->generateSecretKey()), 'two_factor_recovery_codes' => encrypt(json_encode(Collection::times(8, function () { return RecoveryCode::generate(); })->all())), ])->save(); } } 

// app/Policies/DocumentPolicy.php class DocumentPolicy { public function view(User $user, Document $document) { return $this->hasAccess($user, $document, 'read'); } public function update(User $user, Document $document) { return $this->hasAccess($user, $document, 'write') && $this->isWithinTimeWindow($user, $document); } private function hasAccess(User $user, Document $document, string $permission) { return $user->permissions() ->where('resource_type', get_class($document)) ->where('resource_id', $document->id) ->where('permission', $permission) ->where('expires_at', '>', now()) ->exists(); } private function isWithinTimeWindow(User $user, Document $document) { $timeRestriction = $user->timeRestrictions() ->where('resource_type', get_class($document)) ->first(); if (!$timeRestriction) return true; $now = now(); return $now->between( $timeRestriction->start_time, $timeRestriction->end_time ); } } 

// app/Services/AccessControlService.php class AccessControlService { public function evaluateAccess(User $user, $resource, string $action, array $context = []): bool { $rules = $this->getApplicableRules($user, $resource, $action); foreach ($rules as $rule) { if (!$this->evaluateRule($rule, $user, $resource, $action, $context)) { return false; } } return true; } private function evaluateRule(AccessRule $rule, User $user, $resource, string $action, array $context): bool { // Evaluate user attributes if (!$this->checkUserAttributes($rule->user_conditions, $user)) { return false; } // Evaluate resource attributes if (!$this->checkResourceAttributes($rule->resource_conditions, $resource)) { return false; } // Evaluate environmental conditions if (!$this->checkEnvironmentalConditions($rule->environment_conditions, $context)) { return false; } return true; } } 

// app/Http/Controllers/AuthController.php class AuthController extends Controller { public function login(Request $request) { $credentials = $request->validate([ 'email' => 'required|email', 'password' => 'required', 'device_id' => 'required|string', 'ip_address' => 'required|ip' ]); if (!Auth::attempt($credentials)) { throw new UnauthorizedException('Invalid credentials'); } $user = Auth::user(); // Create device fingerprint $deviceFingerprint = $this->createDeviceFingerprint($request); // Generate tokens with device binding $accessToken = $user->createToken('access', ['*'], now()->addMinutes(15)) ->plainTextToken; $refreshToken = $user->createToken('refresh', ['refresh'], now()->addDays(7)) ->plainTextToken; // Store device session DeviceSession::create([ 'user_id' => $user->id, 'device_fingerprint' => $deviceFingerprint, 'ip_address' => $request->ip(), 'last_activity' => now(), ]); return response()->json([ 'access_token' => $accessToken, 'refresh_token' => $refreshToken, 'expires_in' => 900, // 15 minutes ]); } } 

// app/Http/Middleware/AdaptiveRateLimit.php class AdaptiveRateLimit { public function handle(Request $request, Closure $next) { $user = $request->user(); $riskScore = $this->calculateRiskScore($request, $user); $limit = $this->getAdaptiveLimit($riskScore); if (RateLimiter::tooManyAttempts($this->getKey($request), $limit)) { throw new TooManyRequestsHttpException( RateLimiter::availableIn($this->getKey($request)) ); } RateLimiter::hit($this->getKey($request)); return $next($request); } private function calculateRiskScore(Request $request, ?User $user): int { $score = 0; // Geographic risk if ($this->isFromHighRiskLocation($request->ip())) { $score += 30; } // Device risk if ($user && !$this->isKnownDevice($user, $request)) { $score += 25; } // Time-based risk if ($this->isOffHours()) { $score += 15; } // Behavioral anomalies if ($user && $this->detectAnomalous($user, $request)) { $score += 40; } return min($score, 100); } private function getAdaptiveLimit(int $riskScore): int { return match(true) { $riskScore >= 80 => 10, // High risk: 10 requests/minute $riskScore >= 50 => 30, // Medium risk: 30 requests/minute $riskScore >= 20 => 60, // Low risk: 60 requests/minute default => 120 // Trusted: 120 requests/minute }; } } 

// app/Casts/EncryptedJson.php class EncryptedJson implements CastsAttributes { public function get($model, string $key, $value, array $attributes) { if (is_null($value)) { return null; } return json_decode(decrypt($value), true); } public function set($model, string $key, $value, array $attributes) { if (is_null($value)) { return null; } return encrypt(json_encode($value)); } } // app/Models/SensitiveData.php class SensitiveData extends Model { protected $casts = [ 'personal_info' => EncryptedJson::class, 'financial_data' => EncryptedJson::class, ]; } 

// app/Services/EncryptedQueryService.php class EncryptedQueryService { public function searchEncryptedField(string $model, string $field, string $value) { $hashedValue = hash('sha256', $value); return $model::where("{$field}_hash", $hashedValue)->get(); } public function storeWithSearchableHash(Model $model, string $field, string $value) { $model->setAttribute($field, $value); // This gets encrypted via cast $model->setAttribute("{$field}_hash", hash('sha256', $value)); $model->save(); } } 

// app/Http/Middleware/RequestIntegrityCheck.php class RequestIntegrityCheck { public function handle(Request $request, Closure $next) { // Verify request signature if (!$this->verifySignature($request)) { abort(401, 'Invalid request signature'); } // Check for replay attacks if ($this->isReplayAttack($request)) { abort(401, 'Replay attack detected'); } // Validate request structure if (!$this->validateStructure($request)) { abort(400, 'Invalid request structure'); } return $next($request); } private function verifySignature(Request $request): bool { $signature = $request->header('X-Signature'); $timestamp = $request->header('X-Timestamp'); $nonce = $request->header('X-Nonce'); if (!$signature || !$timestamp || !$nonce) { return false; } // Check timestamp freshness (5 minutes) if (abs(time() - $timestamp) > 300) { return false; } $payload = $request->getContent() . $timestamp . $nonce; $expectedSignature = hash_hmac('sha256', $payload, config('app.api_secret')); return hash_equals($expectedSignature, $signature); } } 

// app/Services/SecurityMonitoringService.php class SecurityMonitoringService { public function logSecurityEvent(string $event, User $user = null, array $context = []) { SecurityEvent::create([ 'event_type' => $event, 'user_id' => $user?->id, 'ip_address' => request()->ip(), 'user_agent' => request()->userAgent(), 'context' => $context, 'risk_score' => $this->calculateEventRisk($event, $context), 'timestamp' => now(), ]); // Trigger alerts for high-risk events if ($this->isHighRiskEvent($event, $context)) { $this->triggerSecurityAlert($event, $user, $context); } } public function detectAnomalousActivity(User $user): bool { $recentActivity = SecurityEvent::where('user_id', $user->id) ->where('created_at', '>=', now()->subHour()) ->get(); // Check for unusual patterns return $this->hasUnusualLocationPattern($recentActivity) || $this->hasUnusualTimePattern($recentActivity) || $this->hasUnusualVolumePattern($recentActivity); } } 

// app/Jobs/ThreatDetectionJob.php class ThreatDetectionJob implements ShouldQueue { public function handle() { $suspiciousPatterns = [ 'rapid_login_attempts', 'unusual_data_access', 'privilege_escalation_attempts', 'data_exfiltration_patterns' ]; foreach ($suspiciousPatterns as $pattern) { $threats = $this->detectPattern($pattern); foreach ($threats as $threat) { $this->respondToThreat($threat); } } } private function respondToThreat(array $threat) { switch ($threat['severity']) { case 'critical': $this->lockAccount($threat['user_id']); $this->notifySecurityTeam($threat); break; case 'high': $this->requireReauthentication($threat['user_id']); $this->increaseMonitoring($threat['user_id']); break; case 'medium': $this->triggerStepUpAuth($threat['user_id']); break; } } } 

// app/Http/Middleware/SecureSessionManagement.php class SecureSessionManagement { public function handle(Request $request, Closure $next) { if ($request->user()) { $this->validateSession($request); $this->rotateSessionOnSuspiciousActivity($request); $this->updateSessionActivity($request); } return $next($request); } private function validateSession(Request $request) { $user = $request->user(); $session = UserSession::where('user_id', $user->id) ->where('session_id', session()->getId()) ->first(); if (!$session || $session->is_expired) { Auth::logout(); abort(401, 'Session expired'); } // Validate session fingerprint $currentFingerprint = $this->generateFingerprint($request); if ($session->fingerprint !== $currentFingerprint) { $this->handleSuspiciousActivity($user, 'fingerprint_mismatch'); } } private function generateFingerprint(Request $request): string { return hash('sha256', $request->userAgent() . $request->ip() . $request->header('Accept-Language', '') ); } }