Skip to content

Conversation

@techmahedy
Copy link
Member

Why Model Serialization is Critical

The Security Problem Without It, When we serialize a job containing Entity ORM models without Model Serialization:

class SendEmailJob extends Job
{
    // WITHOUT InteractsWithModelSerialization trait
    protected $user; // User model instance
    
    public function __construct(User $user)
    {
        $this->user = $user;
    }
}

// When dispatched:
$user = User::find(1);
$job = new SendEmailJob($user);
serialize($job); // Serializes ENTIRE user object!

What gets serialized:

  • ALL model attributes (including hidden ones)
  • Password hashes
  • Remember tokens
  • API keys
  • All loaded relationships
  • Timestamps
  • Everything in $attributes array

Security Risks:

  • Data Exposure: Hidden/protected fields are serialized in plain text in the database
  • Stale Data: User data might change between dispatch and execution
  • Large Payloads: Full models with relationships bloat queue storage
  • Password Leaks: Even hashed passwords shouldn't be in queue tables

The Solution: InteractsWithModelSerialization

With InteractsWithModelSerialization trait (now built into Job base class):

class SendEmailJob extends Job
{
    use Dispatchable;
    // InteractsWithModelSerialization already included in Job base class
    
    protected $user; // User model instance
    
    public function __construct(User $user)
    {
        $this->user = $user;
    }
}

// When dispatched:
$user = User::find(1);
$job = new SendEmailJob($user);
serialize($job); // Only stores: ['class' => 'App\Models\User', 'id' => 1]

What gets serialized:

  • ✓ Only the model class name
  • ✓ Only the primary key (ID)
  • ✓ Connection name (if using multiple databases)
  • ✓ Relationship metadata (IDs only, not data)

When job runs:

  • Model is freshly fetched from database: User::find(1)
  • Always gets current data
  • No stale information
  • No security leaks

No changes needed. All jobs now automatically use InteractsWithModelSerialization

@techmahedy techmahedy merged commit cbf6722 into doppar:1.x Nov 16, 2025
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant