Readme.md

Authentication & Authorization

Everything needed to prove who a user is and control what they can do — built secure-by-default with hashed passwords, hardened sessions, anti-CSRF, MFA, and least-privilege access control. Map-of-Content for the Authentication module of Secure PHP Development.

Learning Objectives

• Build login, registration, reset, and verification flows that resist enumeration and brute force.
• Manage sessions and cookies with the correct security attributes.
• Add MFA/TOTP and token-based auth (JWT, OAuth) correctly.
• Enforce authorization with RBAC and the principle of least privilege.

Account Lifecycle

• Password-Based-Login — hashed passwords, session regeneration, generic errors, throttling.
• User-Registration — validation, password policy, safe unique-email handling.
• Password-Reset — single-use expiring tokens, hashed at rest, no enumeration.
• Email-Verification — expiring verification tokens and activation.

Sessions & Cookies

• Session-Management — lifecycle, regeneration, idle/absolute timeout.
• Secure-Cookies — Secure, HttpOnly, scoping.
• SameSite-Cookies — SameSite and CSRF mitigation.
• CSRF-Tokens — synchronizer-token pattern with hash_equals().

Strong & Delegated Auth

• Multi-Factor-Authentication — factors, enrollment, recovery codes.
• Time-Based-OTP-TOTP — RFC 6238 TOTP with QR provisioning.
• OAuth-2 — authorization-code + PKCE flow.
• JSON-Web-Tokens-JWT — signing, validation, and alg confusion.

Authorization

• Role-Based-Access-Control — roles/permissions and server-side enforcement.
• Least-Privilege — minimal privileges across app, DB, and filesystem.

Labs & Exercises

• Lab-Secure-Login-System — hashing, session regeneration, and brute-force throttling.
• Lab-Password-Reset-Flow — single-use expiring reset tokens done safely.
• Lab-JWT-Authentication — issue/verify JWTs and defend the alg-confusion attack.
• Lab-RBAC-Authorization — enforce roles server-side and defeat an IDOR.
• Module challenge: add TOTP-based MFA to the login lab — enrol a secret, verify a 6-digit code with a ±1 step window, and store single-use hashed recovery codes.

Related

• Security — Session-Fixation, Session-Hijacking, Cross-Site-Request-Forgery this module defends.
• Cryptography — the hashing/token primitives behind these flows.
• Login-System, Authentication-System — the applied mini-projects.
• Secure-Session-Configuration — the php.ini/runtime session hardening.