Implementing security routines with zf2

Implementing Security Routines with Zend Framework 2 www.galvao.eti.br
Implementing Security
Routines with
Zend Framework 2
by Er Galvão Abbott
Authentication
Filter & Validation
Password Recovery Cryptography
Authorization
CC Attribution-ShareAlike 3.0 Unported License by Er Galvão Abbott - 11/8/14 - 1 / 34
Brute-Force

Er Galvão Abbott is the President of ABRAPHP – Brazilian
Association of PHP Professionals and Director of
PHP Conference Brasil.
Works for 20 years developing web interfaced systems and
applications, being 15 of those with PHP and 7 with Zend
Framework. Have worked with several companies, both local and
off-shore.
Talks at events, teaches both on-site and on-line courses and is
the founder and leader of the PHPBR UG, a national User Group that
counts with more than 1.200 registered users.
Site: http://www.galvao.eti.br/
Twitter: @galvao
Slides and Documents: http://slideshare.net/ergalvao
https://speakerdeck.com/galvao
Github: http://github.com/galvao
Who?!

Goal
Discuss in both conceptual and technical detail about how to
implement Security Routines with Zend Framework 2.
I'll present the following topics:
→ Authentication
→ Brute-force protection
→ Password recovery
→ Cryptography
→ Authorization
→ Data Filtering and Validation

Security != a piece of cake*
Why? Because, for an example, I'm required to tell you this:
* Not the framework
(Hilarious!)
Before we begin

Security != a piece of cake*
Why? Because, for an example, I'm required to tell you this:
Disclaimer (or the “Not my fault” part)
!Perfect|Complete
$this is... !Fool proof
!The only|right way
Found out an example why? Let me know!
* Not the framework
(Hilarious!)
Before we begin

Authentication

Authentication
ZfcUser, right?!

Authentication
ZfcUser, right?!
YES! Well...

Let's talk about wheels...
Authentication
If you don't [want to]know much about security...
http://modules.zendframework.com/ZF-Commons/ZfcUser

Let's talk about wheels...
Authentication
If you don't [want to]know much about security...
http://modules.zendframework.com/ZF-Commons/ZfcUser
if you do...
Authentication
Crypt
Filter
Form

Now that we've put that aside...
Authentication
Authentication → Service*
Cryptography → (Can also be a) Service*
Authentication attempts → Event
* Yes, yes, it could be done as a Module, Plugin, etc...
-.-”

Authentication
Show me the code!

code
Authentication &
Cryptography
<<

code
Cryptography
<<

code
Authentication
<<

Password Recovery

Password Recovery
Checklist
1. User doesn't “need to change pwd” already;
2. User is “active”;
3. Randomize a temporary pwd;
4. Randomize a temporary, short-life, token;
5. Send a tokenized link for the user to change his pwd;
6. He must correctly enter the temp pwd;
7. If the new pwd and/or token expires, inactivate, make him
contact support;
8. Else, change the pwd, mark the user as “OK”.
9. If any step fails, see step 7!
For your randomization needs: https://github.com/galvao/PHPToolkit*
* Shameless advertising
detected!

Password Recovery
Key points
Know what to do and what to avoid
Lazyness and “user-comfortcentrism” are your enemies

Brute Force

Brute Force
It's all about TIME
1. Generate a timestamp;
2. Log the attempt;
3. Get previous attempt timestamp;
4. Interval = current - previous
5. If the interval is suspicious, lock the user out;
6. If x unsucessful attempts, lock the user out;

Brute Force
Show me the code!

code
Brute Force
<<

Authorization

Authorization
The relation between roles and resources.
Roles can inherit from other roles.
Resources may be available to multiple roles.
It's all about CAN & CAN'T
A few not-so-obvious-things to consider:
1. Everyone has a role;
2. Static storage > Dynamic storage;
3. Ideally, role of the current user should be fetched dynamically...
4. … and a user's role should be “immutable”.

Authorization
ZendPermissionAcl

Filter / Validation

Filter / Validation
1. Filter first, then Validate;
2. Filtering changes data, backup raw data;
3. White List whenever possible (Ideally? ALWAYS)
4. K.I.S.S.

Filter / Validation
4. K.I.S.S. (Keep It Simple, Stupid...)

Filter / Validation
4. K.I.S.S. (Keep It Simple, Stupid...ly beautiful people!)

Filter / Validation Flexibility in ZF2
In the form
Filter &
Validation In the model
Separated

Filter / Validation
Show me the code!

code
Filter &
Validation
<<

Muchas gracias!
? Questions?
↓ Criticism?
↑ Complements?!

Implementing security routines with zf2

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à Implementing security routines with zf2

Similaire à Implementing security routines with zf2 (20)

Plus de Er Galvão Abbott

Plus de Er Galvão Abbott (20)

Dernier

Dernier (20)

Implementing security routines with zf2