Essential PHP Security

Chapter 7. Authentication and Authorization

Many web applications suffer from broken authentication and authorization mechanisms. This chapter discusses vulnerabilities related to these mechanisms and teaches practices that can help you avoid the most common mistakes. These practices are further illustrated with example code, but be careful not to copy an example blindly out of context—it is more important to understand the principles and practices being taught. Only then can you apply them correctly.

Authentication is the process by which a user’s identity is proven. This typically involves a simple username and password check. Thus, a user who is logged in is an authenticated user.

Authorization, often called access control, is how you guard access to protected resources and determine whether a user is authorized to access a particular resource. For example, many web applications have resources that are available only to authenticated users, resources that are available only to administrators, and resources that are available to everyone.

A predominant cause of access control vulnerabilities is carelessness—less care and attention are given to the sections of a web application that are used the least. Administrative features and access control are often an afterthought, and they are written with an authorized user in mind, without considering what an attacker might try to do. An authorized user is trusted more than an anonymous user, but if your administrative features are ...