Tag: security
OAuth 2.0
An authorisation framework that lets users grant third-party applications limited access to their resources without sharing passwords — using short-lived access tokens issued via defined flows for different client types.
CWE-287 OWASP A7:2021
2mo ago
security intermediate
OAuth 2.0 PKCE — Proof Key for Code Exchange
PHP 7.0+ An OAuth 2.0 extension that prevents authorisation code interception attacks in public clients (SPAs, mobile apps) by binding each authorisation request to a cryptographic secret the client generates.
2mo ago
cryptography intermediate
Object Cloning & Security Implications
PHP 5.0+
clone creates a shallow copy — nested objects are still shared references. Implement __clone() for deep copy and audit what sensitive state gets duplicated.
2mo ago
security intermediate
OpenID Connect (OIDC)
PHP 7.0+
An identity layer on top of OAuth 2.0 — while OAuth 2.0 handles authorisation (access to resources), OIDC adds authentication (who the user is) via the ID token.
3mo ago
networking intermediate
OAuth 2.0
PHP 7.0+ An authorisation framework that allows applications to obtain limited access to user accounts on third-party services without exposing passwords.
3mo ago
networking intermediate
openssl_encrypt()
PHP 7.1+
PHP's OpenSSL wrapper for symmetric encryption — use AES-256-GCM for authenticated encryption.
3mo ago
php advanced