- 1. Implementing Security Routines with Zend Framework 2
www.galvao.eti.brImplementing SecurityRoutines withZend Framework
2by Er Galvo AbbottAuthenticationFilter & ValidationPassword
Recovery CryptographyAuthorizationCC Attribution-ShareAlike 3.0
Unported License by Er Galvo Abbott - 11/8/14 - 1 /
34Brute-Force
2. Implementing Security Routines with Zend Framework 2
www.galvao.eti.brEr Galvo Abbott is the President of ABRAPHP
BrazilianAssociation of PHP Professionals and Director ofPHP
Conference Brasil.Works for 20 years developing web interfaced
systems andapplications, being 15 of those with PHP and 7 with
ZendFramework. Have worked with several companies, both local
andoff-shore.Talks at events, teaches both on-site and on-line
courses and isthe founder and leader of the PHPBR UG, a national
User Group thatcounts with more than 1.200 registered users.Site:
http://www.galvao.eti.br/Twitter: @galvaoSlides and Documents:
http://slideshare.net/ergalvaohttps://speakerdeck.com/galvaoGithub:
http://github.com/galvaoWho?!CC Attribution-ShareAlike 3.0 Unported
License by Er Galvo Abbott - 11/8/14 - 2 / 34 3. Implementing
Security Routines with Zend Framework 2
www.galvao.eti.brGoalDiscuss in both conceptual and technical
detail about how toimplement Security Routines with Zend Framework
2.I'll present the following topics: Authentication Brute-force
protection Password recovery Cryptography Authorization Data
Filtering and ValidationCC Attribution-ShareAlike 3.0 Unported
License by Er Galvo Abbott - 11/8/14 - 3 / 34 4. Implementing
Security Routines with Zend Framework 2 www.galvao.eti.brSecurity
!= a piece of cake*Why? Because, for an example, I'm required to
tell you this:CC Attribution-ShareAlike 3.0 Unported License by Er
Galvo Abbott - 11/8/14 - 4 / 34* Not the
framework(Hilarious!)Before we begin 5. Implementing Security
Routines with Zend Framework 2 www.galvao.eti.brSecurity != a piece
of cake*Why? Because, for an example, I'm required to tell you
this:Disclaimer (or the Not my fault part)!Perfect|Complete$this
is... !Fool proof!The only|right wayFound out an example why? Let
me know!CC Attribution-ShareAlike 3.0 Unported License by Er Galvo
Abbott - 11/8/14 - 5 / 34* Not the framework(Hilarious!)Before we
begin 6. Implementing Security Routines with Zend Framework 2
www.galvao.eti.brAuthenticationCC Attribution-ShareAlike 3.0
Unported License by Er Galvo Abbott - 11/8/14 - 6 / 34 7.
Implementing Security Routines with Zend Framework 2
www.galvao.eti.brAuthenticationZfcUser, right?!CC
Attribution-ShareAlike 3.0 Unported License by Er Galvo Abbott -
11/8/14 - 7 / 34 8. Implementing Security Routines with Zend
Framework 2 www.galvao.eti.brAuthenticationZfcUser, right?!YES!
Well...CC Attribution-ShareAlike 3.0 Unported License by Er Galvo
Abbott - 11/8/14 - 8 / 34 9. Implementing Security Routines with
Zend Framework 2 www.galvao.eti.brLet's talk about
wheels...AuthenticationIf you don't [want to]know much about
security...http://modules.zendframework.com/ZF-Commons/ZfcUserCC
Attribution-ShareAlike 3.0 Unported License by Er Galvo Abbott -
11/8/14 - 9 / 34 10. Implementing Security Routines with Zend
Framework 2 www.galvao.eti.brLet's talk about
wheels...AuthenticationIf you don't [want to]know much about
security...http://modules.zendframework.com/ZF-Commons/ZfcUserif
you do...AuthenticationCryptFilterFormCC Attribution-ShareAlike 3.0
Unported License by Er Galvo Abbott - 11/8/14 - 10 / 34 11.
Implementing Security Routines with Zend Framework 2
www.galvao.eti.brNow that we've put that
aside...AuthenticationAuthentication Service*Cryptography (Can also
be a) Service*Authentication attempts Event* Yes, yes, it could be
done as a Module, Plugin, etc...-.-CC Attribution-ShareAlike 3.0
Unported License by Er Galvo Abbott - 11/8/14 - 11 / 34 12.
Implementing Security Routines with Zend Framework 2
www.galvao.eti.brAuthenticationShow me the code!CC
Attribution-ShareAlike 3.0 Unported License by Er Galvo Abbott -
11/8/14 - 12 / 34 13. Implementing Security Routines with Zend
Framework 2 www.galvao.eti.brcodeAuthentication
&Cryptography< Dynamic storage;3. Ideally, role of the
current user should be fetched dynamically...4. and a user's role
should be immutable.CC Attribution-ShareAlike 3.0 Unported License
by Er Galvo Abbott - 11/8/14 - 25 / 34 26. Implementing Security
Routines with Zend Framework 2
www.galvao.eti.brAuthorizationZendPermissionAclCC
Attribution-ShareAlike 3.0 Unported License by Er Galvo Abbott -
11/8/14 - 26 / 34 27. Implementing Security Routines with Zend
Framework 2 www.galvao.eti.brFilter / ValidationCC
Attribution-ShareAlike 3.0 Unported License by Er Galvo Abbott -
11/8/14 - 27 / 34 28. Implementing Security Routines with Zend
Framework 2 www.galvao.eti.brFilter / ValidationA few
not-so-obvious-things to consider:1. Filter first, then Validate;2.
Filtering changes data, backup raw data;3. White List whenever
possible (Ideally? ALWAYS)4. K.I.S.S.CC Attribution-ShareAlike 3.0
Unported License by Er Galvo Abbott - 11/8/14 - 28 / 34 29.
Implementing Security Routines with Zend Framework 2
www.galvao.eti.brFilter / ValidationA few not-so-obvious-things to
consider:1. Filter first, then Validate;2. Filtering changes data,
backup raw data;3. White List whenever possible (Ideally? ALWAYS)4.
K.I.S.S. (Keep It Simple, Stupid...)CC Attribution-ShareAlike 3.0
Unported License by Er Galvo Abbott - 11/8/14 - 29 / 34 30.
Implementing Security Routines with Zend Framework 2
www.galvao.eti.brFilter / ValidationA few not-so-obvious-things to
consider:1. Filter first, then Validate;2. Filtering changes data,
backup raw data;3. White List whenever possible (Ideally? ALWAYS)4.
K.I.S.S. (Keep It Simple, Stupid...ly beautiful people!)CC
Attribution-ShareAlike 3.0 Unported License by Er Galvo Abbott -
11/8/14 - 30 / 34 31. Implementing Security Routines with Zend
Framework 2 www.galvao.eti.brFilter / Validation Flexibility in
ZF2In the formFilter &Validation In the modelSeparatedCC
Attribution-ShareAlike 3.0 Unported License by Er Galvo Abbott -
11/8/14 - 31 / 34 32. Implementing Security Routines with Zend
Framework 2 www.galvao.eti.brFilter / ValidationShow me the code!CC
Attribution-ShareAlike 3.0 Unported License by Er Galvo Abbott -
11/8/14 - 32 / 34 33. Implementing Security Routines with Zend
Framework 2 www.galvao.eti.brcodeFilter &Validation
