tags:

views:

31

answers:

1
+1  Q: 

Sign in with Twitter and Security for a Zend Framework App

Hi,

I'm trying to replicate the functionality i've seen on a couple of sites:

The idea is you sign up and log in with Twitter using Oauth. Once you have authed the app at twitter you then return to their site and they keep you logged in. In the case of each one they obviously base this on cookies as i can return to the site after closing my browser and i am still logged in. This seems inherently insecure, what are they doing here to maintain the login?

I will be using Zend Framework but i guess that doesnt really matter.

+2  A: 

There's nothing wrong with using cookies. Tho you should encrypt the cookeis on server-side, so that a user cannot manipulate its value.

DASPRiD  2010-08-26 15:22:11
in the case where you had - for example - an email address and an accessToken from Oauth then what would you recommend given that it would be necessary to encrypt and decrypyt?
seengee  2010-08-26 15:32:03
Just encrypt both of them.
DASPRiD  2010-08-26 15:54:08
can you recommend a good Zend Framework way of handling this?
seengee  2010-08-26 16:00:08
There's nothing built-in in ZF for that purpose, but I wrote a small class in my blog to handle it: http://site.svn.dasprids.de/trunk/application/library/App/Cookie.php
DASPRiD  2010-08-26 16:03:56
cool, is there a blog article about its usage too?
seengee  2010-08-26 16:10:03
or just an example of its usage?
seengee  2010-08-26 16:10:20
Nope, there isn't, just call App_Cookie::setBlowfishSecret('your-secret'); and then App_Cookie::setEncrypt($key, $value);
DASPRiD  2010-08-26 16:12:09
where would it usually sit within a ZF MVC project - in the library?
seengee  2010-08-26 16:15:39
Excatly, just see where I placed it.
DASPRiD  2010-08-26 16:20:35
haha - didnt notice the path in the URL. thanks :)
seengee  2010-08-26 16:26:21

related questions

IDE suggestions: Eclipse IDE vs. Zend Studio ( confused )
MySQL/Apache Error in PHP MySQL query
Lightweight IDE for Linux
What PHP framework would you choose for a new application and why?
Why is my ternary expression not working?
How can I get at the matches when using preg_replace in PHP?
Mechanisms for tracking DB schema changes
Wordpress theme development offline tools
Using object property as default for method property
How can I get the authenticated user name under Apache using plain HTTP authentication and PHP?
Make XAMPP/Apache serve file outside of htdocs
How do you debug PHP scripts?
PHP Variables passed by value or by reference?
Best way to implement unit testing in PHP
Connect PHP to an AS/400
Best way to access Exchange using PHP?
PHP Session Security
How do I access a remote form in php?
What's the best way to generate a tag cloud from an array? (using h1 through h6 for sizing)
Apache/PHP: error_log per Virtual Host?
How do I track file downloads with apache/PHP
How would you access Object properties from within an object method?
Flat File Databases in PHP
Best way to allow plugins for a PHP application
Latest information on PHP upcoming releases