security.md 4.15 KB
Newer Older
1 2 3
Security
========

Aris Karageorgos committed
4
Good security is vital to the health and success of any application. Unfortunately, many developers cut corners when it comes to security, either due to a lack of understanding or because implementation is too much of a hurdle. To make your Yii powered application as secure as possible, Yii has included several excellent and easy to use security features.
5

6
Hashing and verifying passwords
7
-------------------------------
8

Aris Karageorgos committed
9
Most developers know that passwords cannot be stored in plain text, but many developers believe it's still safe to hash passwords using `md5` or `sha1`. There was a time when using the aforementioned hashing algorithms was sufficient, but modern hardware makes it possible to reverse such hashes very quickly using brute force attacks.
10

Aris Karageorgos committed
11
In order to provide increased security for user passwords, even in the worst case scenario (your application is breached), you need to use a hashing algorithm that is resilient against brute force attacks. The best current choice is `bcrypt`. In PHP, you can create a `bcrypt` hash  using the [crypt function](http://php.net/manual/en/function.crypt.php). Yii provides two helper functions which make using `crypt` to securely generate and verify hashes easier.
12

Larry Ullman committed
13
When a user provides a password for the first time (e.g., upon registration), the password needs to be hashed:
14

Aris Karageorgos committed
15

16
```php
Aris Karageorgos committed
17
$hash = \yii\helpers\Security::generatePasswordHash($password);
18 19
```

Aris Karageorgos committed
20 21 22
The hash can then be associated with the corresponding model attribute, so it can be stored in the database for later use.

When a user attempts to log in, the submitted password must be verified against the previously hashed and stored password:
23 24 25


```php
Aris Karageorgos committed
26
use yii\helpers\Security;
Larry Ullman committed
27
if (Security::validatePassword($password, $hash)) {
28
	// all good, logging user in
Larry Ullman committed
29
} else {
30 31 32 33
	// wrong password
}
```

Aris Karageorgos committed
34
Generating Pseudorandom data
35 36
-----------

Aris Karageorgos committed
37
Pseudorandom data is useful in many situations. For example when resetting a password via email you need to generate a token, save it to the database, and send it via email to end user which in turn will allow them to prove ownership of that account. It is very important that this token be unique and hard to guess, else there is a possibility and attacker can predict the token's value and reset the user's password.
Aris Karageorgos committed
38 39

Yii security helper makes generating pseudorandom data simple:
40 41 42 43 44 45


```php
$key = \yii\helpers\Security::generateRandomKey();
```

Aris Karageorgos committed
46 47
Note that you need to have the `openssl` extension installed in order to generate cryptographically secure random data.

48 49 50
Encryption and decryption
-------------------------

Aris Karageorgos committed
51 52
Yii provides convenient helper functions that allow you to encrypt/decrypt data using a secret key. The data is passed through and encryption function so that only the person which has the secret key will be able to decrypt it.
For example, we need to store some information in our database but we need to make sure only the user which has the secret key can view it (even if the application database is compromised):
53 54 55


```php
Aris Karageorgos committed
56
// $data and $secretKey are obtained from the form
Aris Karageorgos committed
57
$encryptedData = \yii\helpers\Security::encrypt($data, $secretKey);
58 59 60
// store $encryptedData to database
```

Aris Karageorgos committed
61
Subsequently when user wants to read the data:
62 63

```php
Aris Karageorgos committed
64
// $secretKey is obtained from user input, $encryptedData is from the database
Aris Karageorgos committed
65
$data = \yii\helpers\Security::decrypt($encryptedData, $secretKey);
66 67
```

68
Confirming data integrity
69 70
--------------------------------

Aris Karageorgos committed
71 72 73 74
There are situations in which you need to verify that your data hasn't been tampered with by a third party or even corrupted in some way. Yii provides an easy way to confirm data integrity in the form of two helper functions.  

Prefix the data with a hash generated from the secret key and data

75

Aris Karageorgos committed
76 77
```php
// $secretKey our application or user secret, $genuineData obtained from a reliable source 
Aris Karageorgos committed
78
$data = \yii\helpers\Security::hashData($genuineData, $secretKey);
Aris Karageorgos committed
79 80 81 82 83 84
```

Checks if the data integrity has been compromised

```php
// $secretKey our application or user secret, $data obtained from an unreliable source 
Aris Karageorgos committed
85
$data = \yii\helpers\Security::validateData($data, $secretKey);
Aris Karageorgos committed
86
```
87 88 89 90 91 92


Securing Cookies
----------------

- validation
93 94 95 96 97 98 99
- httpOnly

See also
--------

- [Views security](view.md#security)