Recipe for adding MFA, Password check, Breached account check, Security report to a Silverstripe application
A recipe for adding various security-focused modules to a Silverstripe website.
- The nswdpc/silverstripe-authentication-boilerplate, providing:
- Multi-factor Authentication (MFA) for the administration area via the Silverstripe TOTP Authenticator
- Pwned Password checks via the pwnedpasswords API provided by Have I Been Pwned
- Breached account checks via the haveibeenpwned API provided by Have I Been Pwned
- The Silverstripe security extensions module
- The Silverstripe security report module
- The NSWDPC CSP module
- The NSWDPC reCAPTCHA v3 base module
There is no configuration provided in this recipe. Its aim is to bring together a set of Silverstripe security modules to be used together in a standardised way. Default configuration settings can be found in the recipe's modules and can be overridden on a per-project basis.
The authentication boilerplate module provides a standard set of rules for defining access to websites. You can modify these rules using the Silverstripe configuration API.
The only supported way of installing this recipe is via composer
composer require-recipe nswdpc/silverstripe-security-recipe
See the recipe plugin page for information on how recipes work.
We welcome bug reports, pull requests and feature requests on the Github Issue tracker for this project.
Please review the code of conduct prior to opening a new issue.
If you have found a security issue with this module, please email digital[@]dpc.nsw.gov.au in the first instance, detailing your findings.
If you would like to make contributions to the module please ensure you raise a pull request and discuss with the module maintainers.
Please review the code of conduct prior to completing a pull request.