mirror/php-auth
1
0
Fork 0
mirror of https://github.com/delight-im/PHP-Auth.git synced 2025-08-21 07:11:33 +02:00
Code Issues Releases Wiki Activity

Improve cookie handling to fix domain issues and add same-site flag

Browse Source
This commit is contained in:
Marco
2016-07-09 00:48:55 +02:00
parent fff4a59be5
commit 1979799480
2 changed files with 31 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
README.md
View File

@@ -254,8 +254,13 @@ $uuid = \Delight\Auth\Auth::createUuid();
* logout
* full and reliable destruction of session
* session management
* protection against session hijacking
* protection against session hijacking via cross-site scripting (XSS)
* do *not* permit script-based access to cookies
* restrict cookies to HTTPS to prevent session hijacking via non-secure HTTP
* protection against session fixation attacks
* protection against cross-site request forgery (CSRF)
* works automatically (i.e. no need for CSRF tokens everywhere)
* do *not* use HTTP `GET` requests for "dangerous" operations
* throttling
* per IP address
* per account