security - Digital Craftsman

Add maintenance mode while still using Cors headers on Heroku

Heroku offers a maintenance mode. With it, the dyno isn't reached and an iFrame with a maintenance HTML page is shown. But unfortunately it can't be customized any further than customizing the HTML page which is shown in the iFrame. This is problematic when building an API which is used

symfony

Improve security when working with JWT and Symfony

Using JWT for authentication in a SPA with Symfony is very easy thanks to bundles like FOSUserBundle, LexikJWTAuthenticationBundle and JWTRefreshTokenBundle. Unfortunately they don't provide security against XSS attacks (which you can argue isn't really there purpose). In this post I want to show how we can enhance a Symfony application

security

Improve JWT security with single use refresh token

One of the security issues with JWT is the refresh token used to generate a new JWT. Once an attacker gets access to the refresh token, he can use the it to generate as many tokens as he wants until the refresh token expires. An improvement here is a feature

php

Manually check if password is valid in Symfony

Just using the same encoder, encoding a plain password and matching those two against each other seams the logical solution, but doesn't work as the hash won't be exactly the same depending on the hashing algorithm and salt used. Let's start with something easier, generating a password without a salt

php

Prevent XSS through HTML sanitization with HTML purifier

Sanitizing of HTML content from a user is one of the most important parts to secure an application against XSS attacks. In PHP you can use a simple strip_tags() call with a whitelist. But there are more sophisticated solutions like the following. With the HTMLPurifier library you can not

security

Slow user creation because of password generation in fixtures

Creating user for tests can be really time consuming due to the password hashing. This is no accident. The hashing has to be slow. This is no bug, but a feature. Slow in creation also means slow to crack. Creating things like rainbow tables is way more expensive this way.

security

Generate a new JWT public and private key

JSON Web Tokens are becoming more and more common in single page applications and I'm also using them in multiple projects. But I also forget how to generate a new token (private and public keys). Which is a common task as you should have a different token in your development

symfony

Create new JWT when user updates email address (username)

Using JWT for a single page application in combination with Symfony in the backend is great when using the bundles lexik/jwt-authentication-bundle and gesdinet/jwt-refresh-token-bundle. lexik/jwt-authentication-bundle provides general JWT based authentication. gesdinet/jwt-refresh-token-bundle provies a way to add a refresh token to refresh the JWT when it's expired. The

php

Generate strong and user friendly password in PHP

There are multiple ways to generate a very secure password, but I only found a small set of those is also user friendly. Meaning there are no ambiguous characters such as i, l, 1, o, 0, etc. The best version I found so far is the following: public function generateStrongPassword(

php

Symfony http basic auth for debugging on live server

When deploying a Symfony application you usually remove the dev environment for security reasons. Which of course makes it more difficult to debug the system if there are errors occurring. An easy solution would be to hide the dev environment behind a http basic auth. Unfortunately there doesn't seem to

php

Create randomized token with specific length

Random token generation is one of those issues which comes up way to many times while coding. There are a lot of ways to solve it but the "random" part is the difficult one. With PHP 7 there is a new way with random_int() to generate a

security

Problems with open source security

There are many problems in the news regarding open source components when used for security. Most of the time it's about that everyone can read the code and find security holes easier. The more pressing issue in my opionion is that those projects (which power a huge part of our

php

Redirect user to login page on access denied in symfony

Add the following line to your security config(app/config/security.yml) security: access_denied_url: /login