rezzza/security-bundle

Signed requests check

v2.3.2 2017-09-06 14:03 UTC

Requires

• php: >=5.3.2
• doctrine/common: ~2.2
• symfony/framework-bundle: ~2.6|~3.0
• symfony/security-bundle: ~2.6|~3.0

Requires (Dev)

• atoum/atoum: ~2.0
• behat/behat: ~3.0
• behat/mink-extension: ~2.0
• behat/mink-goutte-driver: ~1.1
• behat/symfony2-extension: ~2.0

Suggests

• psr/http-message: Required by \Rezzza\SecurityBundle\Request\Psr7RequestSigner

MIT

• Community contributors

• symfony
• security
• bundle

README

Installation

With Composer

    "require": {
        'rezzza/security-bundle': '~2.0',
    }

Enable Bundle

In AppKernel:

    $bundles = array(
        //....
        new Rezzza\SecurityBundle\RezzzaSecurityBundle(),
        //....
    );

On symfony 2.0

Add factory to your security.yml

security:
    factories:
        - "%kernel.root_dir%/../vendor/bundles/Rezzza/SecurityBundle/Resources/config/services/security.xml"

Request signature checker

Validate a signature sent by client in query string, this signature can have a lifetime.

Criterias are:

• Time send on signature (if replay_protection activated)
• RequestMethod
• http host
• path info
• content - RAW_DATA (posted fields)

It'll hash all theses criterias with a secret defined on security.yml, example:

# security.yml
    firewalls:
        api:
            pattern: ^/api/.*
            request_signature:
                algorithm: SHA1
                # you can easily ignore this when use functional tests by example
                ignore:    %request_signature.ignore%
                # secret of symfony application or an other one
                secret:    %secret%
                # http://.............?_signature=....
                parameter: _signature
                # Do you want to add a lifetime criteria ? By this way the signature will be transitory
                replay_protection:
                    enabled:   true
                    lifetime:  600
                    parameter: _signature_ttl

Build the signature:

$signatureConfig = new SignatureConfig(true, 'sha1', 's3cr3t');
$signedRequest = new SignedRequest(
    'GET',
    'subdomain.domain.tld',
    '/path/to/resources',
    'content',
    $signatureTime // if needed
);

$signature = $signedRequest->buildSignature($signatureConfig);

You can define distant firewall on a config:

rezzza_security:
    firewalls:
        my_firewall:
            # algorithm:        'SHA1' default
            secret:            'IseeDeadPeopleEverywhere'
            # replay_protection: true # default

And then:

$signatureConfig = $this->container->get('rezzza.security.signature_config.my_firewall');

$signedRequest = new SignedRequest(
    'GET',
    'subdomain.domain.tld',
    '/path/to/resources',
    'content',
    $signatureTime // if needed
);

$signature = $signedRequest->buildSignature($signatureConfig);

Do you use PSR7 request ?

$signatureConfig = $this->container->get('rezzza.security.signature_config.my_firewall');

$url     = 'http://domain.tld/api/uri.json?foo= bar';
// example with guzzle psr7 implementation.
$request = new \GuzzleHttp\Psr7\Request('GET', $url);

$signer  = new \Rezzza\SecurityBundle\Request\Psr7RequestSigner($signatureConfig);
$request = $signer->sign($request);

$response = (new \GuzzleHttp\Client())->send($request);

Obfuscate request

If you have critical data coming on your application, you may not want to expose them into symfony profiler. You can easily define which data will not appear on this one on each routes.

rezzza_security:
    request_obfuscator:
        enabled: 1

In your route:

use \Rezzza\SecurityBundle\Controller\Annotations\ObfuscateRequest;

/**
 * @ObfuscateRequest()
 */
public function indexAction(Request $request)
{
}

Will obfuscate all datas on symfony profiler.

@obfuscate("content=*") // obfuscate $request->getContent()
@obfuscate("headers={'foobar'}") // obfuscate $request->headers->get('foobar')
@obfuscate("request_request={"customer[password]"}") // obfuscate $request->request->get('customer')['password']

Keys to obfuscate are:

• format
• content
• content_type
• status_text
• status_code
• request_query ($_GET)
• request_request ($_POST)
• request_headers ($_HEADER)
• request_server ($_SERVER)
• request_cookies ($_COOKIES)
• request_attributes ($request->attributes)
• response_headers
• session_metadata
• session_attributes
• flashes
• path_info
• controller
• locale

WishList

• QueryString or HTTP Headers
• Unit Tests with atoum