Security overview

Kona’s security stack ships in two modules:

• kona-session — HTTP sessions (array / file / cookie / Redis drivers), flash data, previous URL / old input, and CSRF verification.
• kona-auth — hashing, guards, the Auth facade, password resets, gates / policies, API tokens, encryption, CORS, security headers, and rate limiting.

Simple path

Apps from kona new already register session and auth providers and wire StartSession + CSRF in the web middleware stack.

1. Keep SessionServiceProvider and AuthServiceProvider on the bootstrap provider list.
2. Keep StartSession and VerifyCsrfToken on the web stack (/api/* is CSRF-excepted by default).
3. Protect HTML routes with Authenticate; use bearer tokens or AuthenticateWithToken for APIs.
4. Authorize with Gate / policies or Authorize middleware.

Guide map

Topic	Guide
Sessions, flash, drivers	Session
Login, remember me, middleware, hashing, tokens	Authentication
Gates, policies, Authorize	Authorization
Form tokens	CSRF protection
APP_KEY, encrypt / decrypt	Encryption
CORS + response headers	CORS & security headers
Named limiters + throttle middleware	Rate limiting

CSRF and session cookies interact with the HTTP middleware pipeline; password form rules use the HTTP validator.