Authentication/Access Control in PHP

Question

Some time ago I created this LAMP based web. At the time I wrote my own user authentication and access control system. It checks whether the user logged in with a correct password, and whether or not he/she has the correct permission level to access given page. State information is handled via PHP sessions while usernames, salted, hashed passwords and user level are stored in a MySQL back end. All the user inputs are sanitized and etc. Users must access the site wtith SSL.

The problem is that I'm starting to second guess myself and am becoming paranoid about security. So I'm looking for ways to improve it.

Can you give me suggestions for:

• some comprehensive lists of security tests I could implement and run against it
• best practices for implementing this sort of system

Is there a robust open source framework or library set that you could recommend using instead a home grown one? The conventional wisdom is that it is usually better to adopt a mature, tested system than write your own from scratch. What would you recommend?

Answer 1

The Zend framework has authentication built into it although Zend tends to be a bit bloated. It is possible to use only bits and pieces of Zend but I've never tried using just the Authentication bit.

There are also a couple of authentication libraries in PEAR - PEAR::Auth which is in a stable release and PEAR::LiveUser which is in beta and was last released (as beta) in 2008.

I hope that gives you a good start.

Answer 2

1) Since you already wrote your own from scratch I would not throught it away and waste your time and effort to integrate a new external open source framework. Code written by others might not be necessary better than your one, moreover you might not completly understand how to integrate it properly therefor you might add even more secuirty holes to your application.

2) This is a good and short 3 pages guide (unfortunately it's in italian, but you can use Google translator toolbar to translate the all pages) Anyway from what you say you don't seem to be a newby to PHP programming, i would reccomend:

• sanitizing input (but you said you did)
• using at least addslshes (or mysql_real_escape_string) when playing with the DB
• php.ini config: REGISTER_GLOBALS should be Off
• careful about how you set the ERROR_REPORTING, it might prints out private data when encounters an error