Security Best Practices

• Bcrypt Hashing: All passwords hashed with PASSWORD_BCRYPT
• Minimum Length: 8 characters enforced
• No Plain Text: Passwords never stored in plain text
• Reset Tokens: Time-limited (24 hours) and single-use

• Middleware Protection: Use PermissionMiddleware on sensitive routes
• Server-Side Checks: Never rely on client-side permission checks
• Granular Permissions: 21 permissions across 4 categories
• Admin Override: Admin users bypass permission checks

Example Usage:

use App\Middleware\PermissionMiddleware;

// In controller
PermissionMiddleware::require('vm.create');

// Check multiple permissions
PermissionMiddleware::require(['vm.create', 'vm.start'], true);

// Admin only
PermissionMiddleware::requireAdmin();

• Mandatory Verification: Users must verify email before login
• Unique Tokens: Each verification link is unique and single-use
• Admin Approval: Additional layer after email verification
• Prevents Spam: Reduces fake account creation

• Prepared Statements: All queries use PDO prepared statements
• Parameter Binding: User input never concatenated into SQL
• Input Validation: Validate and sanitize all user input

Example:

// GOOD ✓
$stmt = $db->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$userId]);

// BAD ✗
$query = "SELECT * FROM users WHERE id = $userId";

• Atomic Operations: Credit operations use database transactions
• Rollback on Error: Automatic rollback if any step fails
• Data Integrity: Ensures consistent state

• Environment Variables: Store credentials in .env
• Never Commit: Add .env to .gitignore
• Token-Based Auth: Use API tokens, not passwords
• Least Privilege: Grant minimum required permissions

chmod 600 .env

• Sandbox Testing: Test thoroughly before going live
• Webhook Verification: Verify PayPal webhook signatures (recommended)
• HTTPS Required: PayPal requires SSL/TLS in production
• Error Handling: Log all payment errors for review

• Secure Cookies: Use httponly and secure flags
• Session Regeneration: Regenerate session ID on login
• Timeout: Implement session timeout for inactive users
• CSRF Protection: Use CSRF tokens for state-changing operations

Recommended php.ini Settings:

session.cookie_httponly = 1
session.cookie_secure = 1
session.use_strict_mode = 1
session.cookie_samesite = "Strict"

• Required for Production: Always use HTTPS in production
• Let's Encrypt: Free SSL certificates
• Force HTTPS: Redirect HTTP to HTTPS
• HSTS Header: Enable HTTP Strict Transport Security

Apache .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

• Action Tracking: Log all important user actions
• IP Recording: Store IP addresses for security review
• Timestamp: All logs include precise timestamps
• Admin Review: Regular audit log review recommended

Logged Actions:

• User login/logout
• Group purchases
• Credit transactions
• VM operations
• Admin actions
• Group expiry (via cron)