laravel - Forms and security - salting passwords and CSRF -

am right in thinking password salting taken care of in larval? i.e. it's automatic?

also wondering log in form , csrf. wise include on forms post data with, i.e. log in form?

you correct in assuming password salting automatic in laravel. prior storing user's password in database, should encrypting using hash::make($password) uses php's secure bcrypt hashing algorithm (which, in case, generates salt automatically).

in response second question, if create form using blade syntax, csrf token automatically inserted form:

{{ form::open(array('route' => 'login)) }}     // csrf token exist in hidden text input {{ form::close() }} 

if choose generate form without using blade, you're required attach csrf token automatically form, using form::token();.

however, either method, still need apply filter routes laravel needs validate token on. in above example, form post named route 'login', need apply csrf token 'before' filter route:

route::post('login', array('as' => 'login', 'uses' => 'logincontroller@postlogin',  'before' => 'csrf'));