Laravel interview questions and answers for Laravel 13

Laravel interviews test two things at once: whether you understand the framework's core ideas (the service container, the request lifecycle, Eloquent) and whether your knowledge is current. Laravel 13 was released on 17 March 2026 and requires PHP 8.3 or later; Laravel 12 receives security fixes until 24 February 2027. Many teams are still upgrading, so expect questions about both.

Below are 21 questions grouped by level, with model answers checked against the Laravel 13.x documentation. Where Laravel 13 changed how something is written, such as PHP attributes for model and queue configuration or the renamed CSRF middleware, the answer says so, because an interviewer may ask about the version your team runs.

Answers are short on purpose. In a real interview, give the short answer first, then offer an example from your own projects.

Version facts worth knowing

Laravel's policy is 18 months of bug fixes and two years of security fixes for each major release, with a new major release roughly every year.

Beginner questions

1. Describe the Laravel request lifecycle.

Every request enters through public/index.php, which loads Composer's autoloader and creates the application from bootstrap/app.php. The HTTP kernel runs global middleware, the application's service providers are registered and then booted, and the router matches the request to a route or controller. The request passes through the route's middleware, the controller returns a response, and the response travels back out through the middleware to the client.

2. What is the difference between a service provider's register and boot methods?

register should only bind things into the service container. boot runs after all providers have been registered, so it is the place for anything that depends on other services: event listeners, route model bindings, view composers, Model::preventLazyLoading() and similar. User-defined providers are listed in bootstrap/providers.php.

3. What is route model binding?

If a route parameter name matches a type-hinted Eloquent model variable, Laravel fetches the model by primary key automatically and returns a 404 if it does not exist.

use App\Models\User;

Route::get('/users/{user}', function (User $user) {
    return $user->email;
});

// Bind by another column:
Route::get('/posts/{post:slug}', [PostController::class, 'show']);

4. Where do you register middleware in Laravel 11 and later?

In bootstrap/app.php, inside ->withMiddleware(...). Use $middleware->append() or prepend() for global middleware, alias() for short names, and web() or api() to add to those groups. The old app/Http/Kernel.php no longer exists in new applications.

5. How does CSRF protection work in Laravel 13?

The CSRF middleware is now called PreventRequestForgery and is in the web group by default. It first checks the browser's Sec-Fetch-Site header and allows same-origin requests immediately; if that check cannot pass (for example an older browser or a non-HTTPS connection), it falls back to the classic token check using the _token field or the X-CSRF-TOKEN header. VerifyCsrfToken remains as a deprecated alias.

6. How do you validate a request?

For simple cases call $request->validate([...]) in the controller. For anything reused or larger, create a form request with php artisan make:request StorePostRequest; it has an authorize() method and a rules() method, and Laravel runs both before the controller method is called. Use $request->validated() to get only the validated fields.

Intermediate questions

7. What is the service container and why does it matter?

The container manages class dependencies and performs dependency injection. When a controller's constructor asks for an interface, the container resolves the bound implementation. This keeps classes decoupled and makes them easy to test, because a test can swap the binding for a fake.

// In AppServiceProvider::register()
$this->app->bind(PaymentGateway::class, StripeGateway::class);

$this->app->singleton(ReportCache::class, function ($app) {
    return new ReportCache($app->make('cache.store'));
});

8. bind, singleton or scoped?

bind creates a new instance each time it is resolved. singleton creates one instance and reuses it. scoped also creates one instance, but it is flushed when a new lifecycle starts, such as a new request in Laravel Octane or a new job in a queue worker. In long-running processes, prefer scoped for anything that holds per-request state. Laravel also offers a #[Singleton] attribute on the class itself.

9. What are facades? Are they static calls?

Facades are "static proxies" to objects in the service container. Cache::get('key') looks static, but the facade resolves the cache service from the container and calls get on that instance. That is why facades can be faked in tests, for example Mail::fake(). The trade-off is that dependencies are less visible than with constructor injection.

10. Explain the N+1 problem and how to fix it.

Looping over 50 posts and reading $post->author runs one query for the posts and one per post for the author: 51 queries. Eager loading with with() reduces it to two.

$posts = Post::with(['author', 'comments'])->latest()->paginate(20);

// In AppServiceProvider::boot(): fail loudly outside production
Model::preventLazyLoading(! $this->app->isProduction());

Laravel also provides Model::automaticallyEagerLoadRelationships(), which lazy-eager-loads a relationship for the whole collection the first time you access it on one model.

11. What is mass assignment protection?

Methods such as create() and update() accept arrays, so a user could send an unexpected field such as is_admin. Eloquent models are protected by default: you must declare which attributes are fillable (or which are guarded). The Laravel 13 documentation uses the #[Fillable(['name'])] attribute on the model; many existing codebases use the protected $fillable array. Combine either with $request->validated() rather than $request->all().

12. What are accessors, mutators and casts?

Accessors and mutators transform attribute values when you read or write them; in current Laravel they are methods returning Attribute::make(get: ..., set: ...). Casts convert column values to native types, defined in a casts() method, for example 'published_at' => 'datetime', 'options' => 'array' or a backed enum class.

13. Gates or policies?

Both answer "may this user do this?". Gates are closures registered with Gate::define(), suitable for actions not tied to a model, such as viewing an admin dashboard. Policies are classes that group authorization for one model (view, update, delete), created with php artisan make:policy. In controllers, call Gate::authorize('update', $post); Laravel 13 also offers the #[Authorize] controller attribute.

14. Sanctum or Passport?

Sanctum covers two common needs: cookie-based session authentication for your own single-page application, and simple personal API tokens with abilities for mobile apps or scripts. Do not use API tokens for your own first-party SPA; use Sanctum's SPA authentication. Passport is a full OAuth2 server; choose it only when third parties need OAuth flows.

Advanced questions

15. How do queued jobs work, and how do you make them reliable?

A job class implements ShouldQueue; dispatching it serialises the job onto a connection (database, Redis, SQS and others), and php artisan queue:work processes it. For reliability: set attempts and backoff, make the job idempotent, use ShouldBeUnique where duplicates would be harmful, keep a failed-jobs table, run workers under a process manager such as Supervisor, and run php artisan queue:restart on each deploy.

use Illuminate\Contracts\Queue\ShouldQueue;
use Illuminate\Foundation\Queue\Queueable;
use Illuminate\Queue\Attributes\Tries;

#[Tries(5)]
class SendInvoice implements ShouldQueue
{
    use Queueable;

    public function __construct(public Invoice $invoice) {}

    public function handle(InvoiceMailer $mailer): void
    {
        $mailer->send($this->invoice);
    }
}

SendInvoice::dispatch($invoice);

16. What is queue routing in Laravel 13?

Queue::route() sets the default connection and queue for a job class in one central place, usually a service provider, instead of on every dispatch: Queue::route(ProcessPodcast::class, connection: 'redis', queue: 'podcasts');

17. How would you speed up a slow Laravel application?

• Measure first: query logs, Laravel Telescope or Pulse, or your APM.
• Fix N+1 queries, select only needed columns, add database indexes, and paginate.
• Cache expensive results with Cache::remember().
• Move slow work (email, PDFs, third-party APIs) to queues.
• In production run php artisan optimize to cache config, routes, events and views, and enable OPcache.
• Consider Laravel Octane for high-traffic APIs, keeping in mind that state persists between requests.

18. What changes when you run Laravel under Octane?

The application boots once and serves many requests from memory. Anything stored in a singleton, a static property or a container binding can leak between requests. Avoid injecting the request or config repository into singletons, use scoped bindings for per-request services, and watch memory growth.

19. How do database transactions work in Laravel?

DB::transaction(function () { ... }) commits if the closure finishes and rolls back if it throws. You can pass a second argument for the number of deadlock retries. To dispatch jobs or events only after the commit, chain afterCommit() onto the dispatch or set after_commit to true on the queue connection, so a worker never processes a record that was rolled back.

20. How do you test a Laravel application?

Laravel ships with Pest and PHPUnit support. Feature tests call routes with $this->get() or postJson() and assert on the response; the RefreshDatabase trait resets the database; model factories create data; and fakes such as Queue::fake(), Mail::fake() and Http::fake() stop side effects while letting you assert they were requested.

21. What does Laravel 13 add that you might mention?

The first-party Laravel AI SDK for text generation, agents, embeddings, images and audio; JSON:API resources; the PreventRequestForgery middleware; queue routing; more PHP attributes such as #[Middleware], #[Authorize], #[Tries] and #[Timeout]; Cache::touch() to extend a cache item's TTL; and vector similarity queries for PostgreSQL with pgvector.

Practice checklist

• Build a small CRUD application on Laravel 13 with a form request, a policy, a queued job and a feature test.
• Turn on Model::preventLazyLoading() and fix every violation you find.
• Read the 13.x upgrade guide and be ready to describe one upgrade you have done.
• Explain the container in one minute without notes.

Next steps

Laravel questions often lead into PHP language questions and SQL, so review our PHP and MySQL interview sets as well. The official Laravel documentation is versioned; make sure you read the version the company actually uses.