Security in laravel

Security in laravel

• 1.
  AUTHENTICATION AND SECURITYIN LARAVEL REFERENCE: HTTP://LARAVEL.COM/DOCS/SECURITY#CONFIGURATION Sayed Ahmed Computer Engineering, BUET, Bangladesh MSc., Computer Science, Canada http://sayed.justetc.net
• 2.
  AUTH AND SECURITYCONFIGURATIONS  One security setting can be found at  app/config/app.php  'key’ for encryption key, 256 bit AES  http://en.wikipedia.org/wiki/Advanced_Encryption_Sta ndard  Key should be used otherwise the encryption will not be strong  32 characters key
• 3.
  app/config/auth.php  Some authenticationsettings can be found at  app/config/auth.php  <?php  return array(  'driver' => 'eloquent‘,  ‘model' => 'User',  'table' => 'users',  'reminder' => array(  'email' => 'emails.auth.reminder',  'table' => 'password_reminders',  'expire' => 60,  ),  );
• 4.
  AUTH.PHP PARAMETERS  'driver’: eloquent or database  ‘model’ : model used for authentication  'table’ : database table associated with this model  ‘'reminder’ : configuration for password reminder sending
• 5.
  OPTIONS FOR AUTHENTICATIONIMPLEMENTATION  If you do not use Eloquent  Use database authentication driver  Use QueryBuilder  If you use Eloquent ORM  Use eloquent authentication driver  app/models has a model User  password field is a minimum of 60 characters  You will use ORM based data manipulation (retrieve, update)
• 6.
  FUNCTIONS THAT WILLFACILITATE AUTHENTICATION AND SECURITY  Just lightly check, for the most part, you will know what they mean  The Laravel Hash class provides secure Bcrypt hashing:  Hash::make('secret');  Hash::check('secret', $hashedPassword)  Hash::needsRehash($hashed)  Auth  Auth::attempt()  Auth::check()  Auth::viaRemember()  Auth::user()  Auth::loginUsingId(1)  Auth::validate($credentials)  Auth::once($credentials)
• 7.
  FUNCTIONS THAT WILLFACILITATE AUTHENTICATION AND SECURITY  Auth  Auth::login($user)  Auth::logout()  Crypt  Crypt::setMode('ctr')  Crypt::setCipher($cipher)  Crypt::decrypt($encryptedValue)  Crypt::encrypt('secret')  Password  Password::validator()
• 8.
  NOW, SETTING THEPASSWORD  Create a hash for the user provided password  $password = Hash::make('secret');  Hash the password and check it against the hash of the existing password  if (Hash::check('secret', $hashedPassword)) {  // The passwords match...  }
• 9.
  AUTHENTICATE  if (!Auth::check() ) {  // The user is not logged in...  if (Auth::attempt(  array(  ‘db_field_for_username' => $user_provided_username, ‘db_field_for_password' => $password_in_the_login_form )) ) { return Redirect::intended('dashboard'); //closure }  }  Note: Auth:attempt() fires Auth:login on success
• 10.
  AUTHENTICATE WITH CONDITION Condition: Id, password have to match  also the user has to be active  if (Auth::attempt(  array('email' => $email, 'password' => $password, 'active' => 1)))  {  // The user is active, not suspended, and exists.  }  Note: For added protection against session fixation, the user's session ID will automatically be regenerated after authenticating.
• 11.
  REMEMBERING LOGIN USINGCOOKIES  Remember user login status  if (Auth::attempt(  array('email' => $email, 'password' => $password), true)) {  // The user is being remembered...  }  Authentication at a later time if remembered  if (Auth::viaRemember()) {  //  }
• 12.
  MISC  Access theloggedin user  $email = Auth::user()->email;  Check user credentials without actually log him in  if (Auth::validate($credentials)) { // }  Logout  Auth::logout();
• 13.
  PASSWORD RESET ANDREMINDERS  You can use Laravel built-in strategy  There will be password reminder form to initiate the request  Password reset link will be sent to email  Then password reset form will be there  You can use artisan commands to create the table, and the controller  The controller will have all the methods  You just need to write the reminder form and the reset form  Yes, in view files  You need to create the views as well  Must if you want to use this strategy:  Make sure User model implements theIlluminateAuthRemindersRemindableInterface  To Create the related stuff (DB table, controller)  php artisan auth:reminders  php artisan migrate  php artisan auth:reminders-controller
• 14.
  PASSWORD REMINDER FORM The controller will have all the methods  You just need to create the view file and the form in it  password.remind  <form  action="{{ action('RemindersController@postReset') }}" method="POST">  <input type="email" name="email">  <input type="submit" value="Send Reminder">  </form>
• 15.
  PASSWORD RESET  <form action="{{ action('RemindersController@postReset') }}" method="POST">  <input type="hidden" name="token" value="{{ $token }}">  <input type="email" name="email">  <input type="password" name="password">  <input type="password" name="password_confirmation">  <input type="submit" value="Reset Password">  </form>
• 16.
  REFERENCE  http://laravel.com/docs/security#configuration