security.md 3.13 KB
Newer Older
1 2 3
Security
========

4
Good security is vital to the health and success of many websites. Unfortunately, many developers may cut corners when it comes to security due to a lack of understanding or too large of an implementation hurdle. To make your Yii-based site as secure as possible, the Yii framework has baked in several excellent, and easy to use, security features.
5

6
Hashing and verifying passwords
7
-------------------------------
8

Larry Ullman committed
9
Most developers know that you cannot store passwords in plain text, but many believe it's safe to hash passwords using `md5` or `sha1`. There was a time when those hashing algorithms were sufficient, but modern hardware makes it possible to break those hashes very quickly using a brute force attack.
10

Larry Ullman committed
11
In order to truly secure user passwords, even in the worst case scenario (your database is broken into), you need to use a hashing algorithm that is resistant to brute force attacks. The best current choice is `bcrypt`. In PHP, you can create a `bcrypt` hash by using the [crypt function](http://php.net/manual/en/function.crypt.php). However, this function is not easy to use properly, so Yii provides two helper functions to make securely generating and verifying hashes easier.
12

Larry Ullman committed
13
When a user provides a password for the first time (e.g., upon registration), the password needs to be hashed:
14 15 16 17 18

```php
$hash = \yii\helpers\Security::generatePasswordHash($password);
```

Larry Ullman committed
19
The hash would then be associated with the model, so that it will be stored in the database for later use.
20

Larry Ullman committed
21
When user attempts to log in, the submitted log in password must be verified against the previously hashed and stored password:
22 23

```php
Larry Ullman committed
24 25
use \yii\helpers;
if (Security::validatePassword($password, $hash)) {
26
	// all good, logging user in
Larry Ullman committed
27
} else {
28 29 30 31 32
	// wrong password
}
```


33
Creating random data
34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67
-----------

Random data is useful in many cases. For example, when resetting a password via email you need to generate a token,
save it to database and send it via email to end user so he's able to prove that email belongs to him. It is very
important for this token to be truly unique else there will be a possibility to predict a value and reset another user's
password.

Yii security helper makes it as simple as:

```php
$key = \yii\helpers\Security::generateRandomKey();
```

Encryption and decryption
-------------------------

In order to encrypt data so only person knowing a secret passphrase or having a secret key will be able to decrypt it.
For example, we need to store some information in our database but we need to make sure only user knowing a secret code
can view it (even if database is leaked):


```php
// $data and $secretWord are from the form
$encryptedData = \yii\helpers\Security::encrypt($data, $secretWord);
// store $encryptedData to database
```

Then when user want to read it:

```php
// $secretWord is from the form, $encryptedData is from database
$data = \yii\helpers\Security::decrypt($encryptedData, $secretWord);
```

68
Confirming data integrity
69 70
--------------------------------

71 72
Making sure data wasn't modified

73 74 75 76 77 78 79 80
hashData()
validateData()


Securing Cookies
----------------

- validation
81 82 83 84 85 86 87
- httpOnly

See also
--------

- [Views security](view.md#security)