Securing PHP Applications 🛡️

<?php
// Security headers are extra instructions you send WITH the page that tell
// the browser how to behave. They must be sent BEFORE any echo/HTML output,
// because once the body starts, the headers are already on their way.

// Content-Security-Policy (CSP): a whitelist of where the browser may load
// scripts, styles and images from. The single best defence against XSS — even
// if an attacker injects a <script>, the browser refuses to run it.
$headers = [
    "Content-Security-Policy"   => "default-src 'self'; script-src 'self'",
    "Strict-Transport-Security" => "max-age=31536000; includeSubDomains", // HSTS: force HTTPS for a year
    "X-Frame-Options"           => "DENY",       // can't be put in an <iframe> -> stops clickjacking
    "X-Content-Type-Options"    => "nosniff",    // don't guess file types
    "Referrer-Policy"           => "no-referrer", // don't leak the URL you came from
];

foreach ($headers as $name => $value) {
    // header("{$name}: {$value}");  // <- the real call in a live request
    echo "{$name}: {$value}\n";     // we echo here just to SEE them
}
?>

Content-Security-Policy: default-src 'self'; script-src 'self'
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer

<?php
// === Encryption AT REST: scramble sensitive data before it touches the disk ===
// Use the modern sodium extension (built into PHP 7.2+). It picks safe defaults
// so you can't accidentally choose a broken cipher.

$key       = sodium_crypto_secretbox_keygen();           // 32-byte secret key
$nonce     = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES); // unique per message
$plaintext = "Patient SSN: 123-45-6789";

// Encrypt: turns readable text into ciphertext nobody can read without the key.
$cipher = sodium_crypto_secretbox($plaintext, $nonce, $key);
echo "Ciphertext bytes: " . strlen($cipher) . " (unreadable)\n";

// Decrypt: only the holder of the key + nonce gets the original back.
$decrypted = sodium_crypto_secretbox_open($cipher, $nonce, $key);
echo "Decrypted: {$decrypted}\n";

// === SSRF: never let user input pick which URL the server fetches ===
// VULNERABLE: file_get_contents(\$_GET['url']);  ?url=http://169.254.169.254/
// An attacker could point it at internal cloud-metadata or your own database.
function safeFetch(string $url): string
{
    $host = parse_url($url, PHP_URL_HOST);                // pull out the hostname
    $allowed = ['api.example.com', 'cdn.example.com'];    // only trust these
    if (!in_array($host, $allowed, true)) {
        return "BLOCKED: '{$host}' is not an allowed host";
    }
    return "Fetching from {$host} ...";
}
echo safeFetch("https://api.example.com/data") . "\n";
echo safeFetch("http://169.254.169.254/latest/meta-data/") . "\n";
?>

Ciphertext bytes: 40 (unreadable)
Decrypted: Patient SSN: 123-45-6789
Fetching from api.example.com ...
BLOCKED: '169.254.169.254' is not an allowed host

<?php
// === JWT pitfalls: a JWT is just signed JSON — verify it PROPERLY ===
// A token has three parts: header.payload.signature
// The two classic mistakes are (1) trusting the 'alg' the TOKEN claims, and
// (2) forgetting to check the expiry. We model the checks here.

function verifyToken(array $token, string $expectedAlg, int $now): string
{
    // 1) ALG CONFUSION: never trust token['alg']. Demand the algorithm YOU chose.
    //    Attackers send alg:"none" or swap RS256->HS256 to forge signatures.
    if ($token['alg'] !== $expectedAlg) {
        return "REJECTED: alg '{$token['alg']}' != expected '{$expectedAlg}'";
    }
    // 2) EXPIRY: a token without an 'exp' check is valid forever -> reject it.
    if (!isset($token['exp']) || $token['exp'] < $now) {
        return "REJECTED: token expired or has no expiry";
    }
    return "ACCEPTED: user {$token['sub']}";
}

$now = 1000;
echo verifyToken(['alg' => 'HS256', 'sub' => 'ada', 'exp' => 2000], 'HS256', $now) . "\n";
echo verifyToken(['alg' => 'none',  'sub' => 'eve', 'exp' => 2000], 'HS256', $now) . "\n";
echo verifyToken(['alg' => 'HS256', 'sub' => 'bob', 'exp' => 500 ], 'HS256', $now) . "\n";
?>

ACCEPTED: user ada
REJECTED: alg 'none' != expected 'HS256'
REJECTED: token expired or has no expiry

<?php
// === Secure file handling: an upload is just attacker-controlled bytes ===
// Three rules: validate the TYPE, generate your OWN name, store OUTSIDE webroot.

function acceptUpload(string $clientName, string $mime, int $size): string
{
    // 1) Whitelist the content type — never trust the file extension alone.
    $allowedMimes = ['image/png' => 'png', 'image/jpeg' => 'jpg'];
    if (!isset($allowedMimes[$mime])) {
        return "REJECTED: type '{$mime}' not allowed";
    }
    // 2) Cap the size so nobody fills your disk.
    if ($size > 2_000_000) {           // 2 MB
        return "REJECTED: file too large";
    }
    // 3) NEVER reuse the client's filename ('../../shell.php' is an attack).
    //    Generate a random, safe name with the extension YOU decided.
    $safeName = bin2hex(random_bytes(8)) . '.' . $allowedMimes[$mime];
    return "STORED as {$safeName} (original '{$clientName}' ignored)";
}

echo acceptUpload("cat.png", "image/png", 50_000) . "\n";
echo acceptUpload("shell.php", "application/x-php", 1_000) . "\n";
?>

STORED as a3f1c0d9e2b48a17.png (original 'cat.png' ignored)
REJECTED: type 'application/x-php' not allowed

<?php
// 🎯 YOUR TURN — finish the security-header set, then run it.
// You're adding the two headers most often forgotten.

$headers = [
    "Content-Security-Policy" => "default-src 'self'",
];

// 1) Add HSTS so the browser ALWAYS uses HTTPS for a year.
$headers[___] = "max-age=31536000";   // 👉 the key is "Strict-Transport-Security"

// 2) Add the header that blocks your page from being framed (clickjacking).
$headers["X-Frame-Options"] = ___;    // 👉 the value is "DENY"  (in quotes)

foreach ($headers as $name => $value) {
    echo "{$name}: {$value}\n";
}

// ✅ Expected output:
//    Content-Security-Policy: default-src 'self'
//    Strict-Transport-Security: max-age=31536000
//    X-Frame-Options: DENY
?>

Content-Security-Policy: default-src 'self'
Strict-Transport-Security: max-age=31536000
X-Frame-Options: DENY

<?php
// 🎯 YOUR TURN — close the alg-confusion hole.
// This verifier checks the expiry but FORGETS to pin the algorithm,
// so a forged alg:"none" token sails through. Add the missing guard.

function verify(array $token, int $now): string
{
    // 👉 Reject the token unless its alg is EXACTLY "HS256".
    if (___ !== "HS256") {            // 👉 compare $token['alg'] to "HS256"
        return "REJECTED: bad alg";
    }
    if ($token['exp'] < $now) {
        return "REJECTED: expired";
    }
    return "ACCEPTED: {$token['sub']}";
}

echo verify(['alg' => 'HS256', 'sub' => 'ada', 'exp' => 999], 500) . "\n";
echo verify(['alg' => 'none',  'sub' => 'eve', 'exp' => 999], 500) . "\n";

// ✅ Expected output:
//    ACCEPTED: ada
//    REJECTED: bad alg
?>

ACCEPTED: ada
REJECTED: bad alg