MULTI-LEVEL DATA PROTECTION IN LARAVEL APPLICATIONS

Abstract

In the modern context of the growing number of cyber threats, the problem of data protection in web applications is becoming particularly relevant. Laravel, as one of the most widespread PHP frameworks, is widely used for the development of business applications, educational platforms, and information systems, which necessitates a comprehensive analysis of its security capabilities. The article systematizes the built-in Laravel protection mechanisms, including prevention of SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), as well as basic authentication and authorization tools. The limitations of standard solutions in high-load environments have been identified, which determines the need for integration of advanced approaches. A multi-level data protection model in Laravel has been developed, which combines built-in mechanisms with advanced solutions: the use of the Argon2 hashing algorithm instead of bcrypt to enhance cryptographic strength; the implementation of two-factor authentication; the application of access policies and rate limiting to protect APIs; the integration of anomaly detection mechanisms for requests. The proposed model has been formalized through a mathematical description of risks and time costs, which makes it possible to compare the performance of different solutions. Experimental studies were conducted in a test environment using Apache Benchmark and Siege. The obtained results indicate that the use of Argon2 increases the processing time of authentication requests by an average of 12–15% compared to bcrypt, but significantly enhances the level of protection. The use of rate limiting reduced the risk of brute force attacks by 40%, while the implementation of access policies significantly decreased the number of unauthorized access attempts. As a result, it has been proven that the integration of basic and advanced mechanisms forms an optimal model of data protection in Laravel applications, which ensures a balance between performance and security. Further research involves the use of adaptive methods for anomaly detection in traffic and the development of automated tools for assessing the security level of web applications.