Security

1Introduction

Temma natively provides a set of tools to secure your web applications: authentication and access control, incoming data validation, protection against SQL injections, XSS and CSRF, secure sessions…

This page gives an overview of security best practices in a Temma application. Each section links to the detailed documentation pages.

2Authentication and access control

Temma provides a complete user authentication system, as well as an access control mechanism based on roles and services.

  • The Authentication page explains step-by-step how to set up a passwordless authentication system.
  • The Auth controller/plugin manages the login form, the sending of magic links by email, and the user session.
  • The Auth attribute restricts access to controllers and actions depending on the user's authentication, roles and services.
  • The API plugin secures APIs with public/private key authentication.

3Incoming data validation

Any data coming from the outside (URL parameters, GET and POST variables, JSON payload, uploaded files) must be validated before being used.

  • The Data validation page presents Temma's complete validation system, for both incoming and outgoing data.
  • The Check attributes validate incoming data in a declarative way, directly on controllers and actions.
  • The DataFilter helper validates and filters data based on a contract defining the expected type and constraints.

4SQL injections

An SQL injection consists in executing arbitrary queries by taking advantage of data inserted into a query without escaping. Never build an SQL query by concatenating unescaped data.

The SQL data source provides everything you need to protect yourself:

  • The parameters parameter of the exec(), queryOne() and queryAll() methods, which automatically escapes values.
  • Prepared requests, whose parameters are also automatically escaped.
  • The quote() and quoteNull() methods for explicit escaping.

5Cross-site scripting (XSS)

An XSS attack consists in making the site display malicious HTML or JavaScript code, usually injected through user-provided content.

  • The Smarty view enables automatic escaping by default: all variables displayed in templates are escaped, unless the |raw modifier is explicitly used. Use this modifier only on safe content.
  • The HTMLCleaner helper cleans HTML streams provided by users (for example from a WYSIWYG editor), removing any forbidden code.

6Cross-site request forgery (CSRF)

A CSRF attack consists in making an authenticated user unknowingly execute a sensitive action, by triggering a request to your site from a third-party site.

Three mechanisms combine to protect against it:

  • Accept only POST requests for sensitive actions, thanks to the Method attribute.
  • Session cookies created by Temma have the SameSite=Lax parameter: they are not sent along POST requests coming from another domain. A POST request forged from a third-party site thus arrives without a session, and the action protected by authentication is denied.
  • The Referer attribute checks that the request actually comes from a page of your own site.

7Server-side request forgery (SSRF)

An SSRF attack consists in making the server itself perform requests to a target controlled by the attacker (for example an internal service unreachable from the outside), by manipulating incoming data used to build the request.

The main protection is the strict validation of incoming data used to build server-side requests. As much as possible, do not let the user provide a free URL: prefer a whitelist of allowed values (for example with the enum type of the DataFilter), from which the server builds the final URL itself.

8Sessions and cookies

Sessions managed by Temma are secure by default:

  • Session cookies are created with the httponly (inaccessible from JavaScript), secure (over HTTPS) and SameSite=Lax parameters (see the CSRF section above).
  • Session identifiers are generated by a cryptographically secure pseudo-random generator.
  • Session data is stored on the server side (by PHP's session engine, or in a data source such as Redis or Memcache); only the session identifier travels in the cookie.

9The x-security configuration

Security-related configuration directives are grouped in the extended configuration x-security of the etc/temma.php file.

Key Role Used by
redirect Default redirection URL when access is denied Auth, Method, Referer and Check attributes
authRedirect Specific redirection URL when authentication is denied Auth attribute
authVariable Name of the template variable containing the current user Auth attribute
methodRedirect Specific redirection URL when the HTTP method is denied Method attribute
refererRedirect, refererDomain, refererUrl, refererPath Redirection and referer check criteria Referer attribute
auth Sub-configuration of the authentication system (customization of emails, tables, etc.) Auth controller/plugin and API plugin

Example:

<?php

return [
    'x-security' => [
        // default redirection when access is denied
        'redirect'     => '/',
        // redirection to the login form when not authenticated
        'authRedirect' => '/auth/login',
    ]
];