LAB_03publié
Application security — Mijote Maison (GRETA)
Educational PHP MVC / MySQL project with application protections, a security report and public source code.
PHPMySQLPDOCSRFSessionsCSP
Sources you can inspect
- Security report ↗
Protections, code excerpts and limitations of the GRETA project.
- CSRF token implementation ↗
Token generation and comparison using hash_equals.
- Security function tests ↗
PHPUnit tests for CSRF tokens and password hashing.
Apply security protections in an educational web application and make the decisions verifiable in its source code.
- 01MySQL access through PDO prepared statements in repositories.
- 02CSRF tokens generated with random_bytes and checked with hash_equals.
- 03HttpOnly / SameSite session cookies and session ID regeneration after login.
- 04File validation, CSP headers and authentication logging.
- 05Security report and PHPUnit tests for security functions.
- Controls are centralized in security functions reused by controllers.
- The report describes the application protections and remaining improvements of an educational project.
Skills practised
- ▸Application security
- ▸PHP MVC / MySQL
- ▸Input validation
- ▸Documenting protections
Verifiable material
- ◆Public source code
- ◆Security report available
- ◆Security tests included in the repository