All fixes

Restrict access to Laravel Horizon

tech-laravel-horizon

The Horizon dashboard is public, exposing queue names, job payloads and failure detail. Restrict it with the Horizon gate so only admins see it.

Why this matters

Laravel Horizon's queue dashboard is publicly accessible. It reveals job queue infrastructure — reconnaissance data, not directly exploitable.

Laravel

  1. 1 Restrict Horizon dashboard access to authorized users via HorizonServiceProvider
php 
// In app/Providers/HorizonServiceProvider.php
protected function gate()
{
    Gate::define('viewHorizon', function ($user) {
        return in_array($user->email, [
            '[email protected]',
        ]);
    });
}
Laravel docs

Does your app still have this?

Scan your domain