Wallogit.com
2017 © Pedro Peláez
A secure user authentication class for PHP websites, using a powerful password hashing system and attack blocking to keep your website and users secure.
, (*1)
PHPAuth is a secure user authentication class for PHP websites, using a powerful password hashing system and attack blocking to keep your website and users secure., (*2)
PHPAuth is work in progress, and not meant for people that doesn't know how to program, its meant for people that know what they are doing.. We cannot help everyone because they dont understand this class.., (*3)
IT'S NOT FOR BEGINNERS!, (*4)
PHPAuth can now be installed with the following command:, (*5)
composer require phpauth/phpauth, (*6)
Then: require 'vendor/autoload.php';, (*7)
The database table config contains multiple parameters allowing you to configure certain functions of the class., (*8)
site_name : the name of the website to display in the activation and password reset emailssite_url : the URL of the Auth root, where you installed the system, without the trailing slash, used for emails.site_email : the email address from which to send activation and password reset emailssite_key : a random string that you should modify used to validate cookies to ensure they are not tampered withsite_timezone : the timezone for correct datetime valuessite_activation_page : the activation page name appended to the site_url in the activation emailsite_password_reset_page : the password reset page name appended to the site_url in the password reset emailcookie_name : the name of the cookie that contains session information, do not change unless necessarycookie_path : the path of the session cookie, do not change unless necessarycookie_domain : the domain of the session cookie, do not change unless necessarycookie_secure : the HTTPS only setting of the session cookie, do not change unless necessarycookie_http : the HTTP only protocol setting of the session cookie, do not change unless necessarycookie_remember : the time that a user will remain logged in for when ticking "remember me" on login. Must respect PHP's strtotime format.cookie_forget : the time a user will remain logged in when not ticking "remember me" on login. Must respect PHP's strtotime format.bcrypt_cost : the algorithmic cost of the bcrypt hashing function, can be changed based on hardware capabilitiessmtp : 0 to use sendmail for emails, 1 to use SMTPsmtp_host : hostname of the SMTP serversmtp_auth : 0 if the SMTP server doesn't require authentication, 1 if authentication is requiredsmtp_username : the username for the SMTP serversmtp_password : the password for the SMTP serversmtp_port : the port for the SMTP serversmtp_security : NULL for no encryption, tls for TLS encryption, ssl for SSL encryptionverify_password_min_length : minimum password length, default is 3 verify_email_min_length : minimum EMail length, default is 5
verify_email_max_length : maximum EMail length, default is 100
verify_email_use_banlist : use banlist while checking allowed EMails (see /files/domains.json), default is 1 (true)attack_mitigation_time : time used for rolling attempts timeout, default is +30 minutes. Must respect PHP's strtotime format.attempts_before_verify : maximum amount of attempts to be made within attack_mitigation_time before requiring captcha. Default is 5
attempt_before_ban : maximum amount of attempts to be made within attack_mitigation_time before temporally blocking the IP address. Default is 30
password_min_score : the minimum score given by zxcvbn that is allowed. Default is 3
The rest of the parameters generally do not need changing., (*9)
If isBlocked() returns verify, then a CAPTCHA code should be displayed.
The method checkCaptcha($captcha) is called to verify a CAPTCHA code. By default this method returns true, but should be overridden to verify a CAPTCHA., (*10)
For example, if you are using Google's ReCaptcha NoCaptcha, use the following code:, (*11)
private function checkCaptcha($captcha)
{
try {
$url = 'https://www.google.com/recaptcha/api/siteverify';
$data = ['secret' => 'your_secret_here',
'response' => $captcha,
'remoteip' => $this->getIp()];
$options = [
'http' => [
'header' => "Content-type: application/x-www-form-urlencoded\r\n",
'method' => 'POST',
'content' => http_build_query($data)
]
];
$context = stream_context_create($options);
$result = file_get_contents($url, false, $context);
return json_decode($result)->success;
}
catch (\Exception $e) {
return false;
}
}
If a CAPTCHA is not to be used, please ensure to set attempt_before_block to the same value as attempts_before_verify., (*12)
Making a page accessible only to authenticated users is quick and easy, requiring only a few lines of code at the top of the page:, (*13)
isLogged()) {
header('HTTP/1.0 403 Forbidden');
echo "Forbidden";
exit();
}
?>
The language for error and success messages returned by PHPAuth can be configured by passing in one of
the available languages as the third parameter to the Auth constructor. If no language parameter is provided
then the default en_GBlanguage is used., (*14)
Example: $auth = new PHPAuth\Auth($dbh, $config, "fr_FR");, (*15)
Available languages:, (*16)
ar-TNcs_CZda_DKde_DEen_GB (Default)es_MXfa_IRfr_FRgr_GRhu_HUid_IDit_ITnl_BEnl_NLno_NBpl_PLps_AFpt_BRru_RUse_SEsr_RSth_THuk_UAvi_VNAll class methods are documented in the Wiki
System error codes are listed and explained here, (*17)
Anyone can contribute to improve or fix PHPAuth, to do so you can either report an issue (a bug, an idea...) or fork the repository, perform modifications to your fork then request a merge., (*18)
A secure user authentication class for PHP websites, using a powerful password hashing system and attack blocking to keep your website and users secure.
MIT
authentication class secure