Security

General security considerations

• Use SSL to prevent man in the middle attacks (MITM). Serving an application over HTTP is wicked.
• Web servers should have their document root set to a nested directory of the application source. This prevents badly configured web servers from accidentally serving source code. WebEngine uses the www/ directory for this.

User input

• Generate and validate a random token for every form submission, preventing cross-site request forgery (CSRF). WebEngine automatically handles CSRF by default.
• Prevent all user input from being read by third party code without consent. WebEngine has protected superglobals and encrypted sensitive fields for this reason.

Authentication

• Wherever possible, use an existing authentication mechanism. The perfect solution is never to handle usernames and passwords. PHP.Gt has a planned authentication mechanism in development to handle authentication for its applications.
• Use OAuth wherever possible.
• Validate OAuth fields to whitelist services.
• Never user HTTP Basic Auth.
• Use account locking or shadow banning for authentication abuse.
• Log all authentication for auditing.