Fetch a user-supplied URL without opening an SSRF hole
Postback URLs, webhook targets and site verification all mean fetching an address someone else chose. This is the guarded version.
Auth and Security
Password handling, sessions, CSRF, 2FA, headers and safe outbound requests.
9 entries
Session cookie settings that survive a security review
Five flags and one call to regenerate. Defaults leave the session cookie readable by scripts and sendable over plain HTTP.
CSRF tokens without a framework
One token per session, compared in constant time, checked on every state-changing POST. Twenty lines and no dependency.
Two-factor authentication in plain PHP, no library
TOTP is HMAC-SHA1 over a time counter, truncated to six digits. About forty lines, and it works with every authenticator app.
Throttle logins by account and by address, separately
One attacker with many addresses and many attackers on one address are different attacks. A single counter catches only one of them.
Suspend an account without deleting it
A status column, one check in the session guard, and a shadow-banned tier that keeps working while earning nothing.
An audit log you will actually be glad you kept
Every admin action and every login, with who, what, from where. Append-only, and never editable from the panel that writes it.
Security headers, and how to allow or refuse framing
Set the cheap headers everywhere. Framing is the one to decide deliberately: a site that refuses to be embedded cannot be shown in a rotator or an exchange.
Generate a QR code in PHP with no dependencies
For a TOTP enrolment screen, calling an image API posts the secret to a third party. A byte-mode encoder is a few hundred lines, and two specific bugs will cost you a day.