How do I secure a hardcoded login/password in PHP?

Question

I'm writing a simple PHP script to access the Foursquare API. The PHP will always access the same Foursquare account. For the time being, I have this login information hardcoded in my script. What is the best way to secure this information?

If I follow the advice from this thread, I should just place the login information in a config file outside the website's root directory: http://stackoverflow.com/questions/97984/how-to-secure-database-passwords-in-php

Is this the best advice? Or is there a better way to secure the login information?

Answer 1

The best way, of course, would be to not store it at all.

If you can't do that, storing it inside a PHP file (as variables) should ensure it's not going to be sent to the client side. If you're really paranoid about your web server suddenly stopping to interpret PHP, you can put it in a separate file, outside the document root, or where access is denied (through a .htaccess directive, for instance).

Answer 2

storing it in a .php file as a variable outside the root directory in a filename that is not something easily guessed is a reasonable secure way of keeping your credentials safe. But if you can avoid storing it on the server at all then that would be best. Provide a login page to enter that information into upon demand to be used for the session and then discarded once you no longer need it.

Answer 3

The password should not be stored as plain text, but you should only store the hash (sha1) of that password and then when validating, process the input the same way and test whether the two hashes are the same. Then keep the actual password somewhere else (like Keepass)

Something like :

$salt = 'bar';   // should be a longer, complicated string with extended chars

$user = 'user';   // stored user name
$hash = '0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33';  // stored password

$input_user = $_POST['txt_user');   // in this example, should be "user"
$input_pass = $_POST['txt_pass'];   // in this example, should be "foo"

if ($user === $input_user && sha1( $input_pass . $salt ) === $hash) {
   echo "Success!";
} else {
   echo "Wrong password...";
}

You could even put that password string into a text file in the form of

user:0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33

and load that like

$rows = file('path/to/password.file');
$valid = false;

foreach ($rows as $line) {
   list($row_user, $row_pass) = explode(':', $line);

   if ($user === $input_user && sha1( $input_pass . $salt ) === $hash) {
      $valid = true;
      break;
   } 
}

if ($valid) {
   echo "Success!";
} else {
   echo "Wrong password...";
}

This way, your data is separated from the code and can easily be modified (from an IT, of course!). The file should be outside of your document root, obviously, or denied access via .htaccess file. Usually, any file starting with a dot are not allowed access.

Answer 4

(There are linux-specific details here, so please forgive them if that's not your platform...)

If you're running on apache and have access to the configuration files (which may not be the case with shared hosting), you can put a line like this in your VirtualHost config (or httpd.conf, or other included config file):

SetEnv FOURSQUARE_PW "your password"

Then your php scripts can access it at $_SERVER['FOURSQUARE_PW'].

The advantage here is that you can make that config file readable only by root, since apache will be started as root using init.d.