Fetch a user-supplied URL without opening an SSRF hole
Postback URLs, webhook targets and site verification all mean fetching an address someone else chose. This is the guarded version.
Auth and Security
Password handling, sessions, CSRF, 2FA, headers and safe outbound requests.
8 entries
Session cookie settings that survive a security review
Five flags and one call to regenerate. Defaults leave the session cookie readable by scripts and sendable over plain HTTP.
CSRF tokens without a framework
One token per session, compared in constant time, checked on every state-changing POST. Twenty lines and no dependency.
Two-factor authentication in plain PHP, no library
TOTP is HMAC-SHA1 over a time counter, truncated to six digits. About forty lines, and it works with every authenticator app.
Throttle logins by account and by address, separately
One attacker with many addresses and many attackers on one address are different attacks. A single counter catches only one of them.
Suspend an account without deleting it
A status column, one check in the session guard, and a shadow-banned tier that keeps working while earning nothing.
An audit log you will actually be glad you kept
Every admin action and every login, with who, what, from where. Append-only, and never editable from the panel that writes it.
Security headers, and which pages must be exempt
A tight Content-Security-Policy breaks ad embeds and pasted network code. Set it globally, exempt the pages that carry third-party markup.