secure-website - Secure website with a registration, sign in, sessi

项目说明

Secure Website

Secure website with a registration, sign in, session management, and CRUD controls. No framework was used.

Used PHP Data Objects (PDO) for securely accessing a database in PHP (MySQL database included).

Used CSS Flexbox for the responsi.

All the scripts are successfully with Markup Service.

Built with security in mind. The following attacks are pre in the code:

* sign in brute force,
* session fixation,
* SQL injection,
* cross-site scripting (XSS),
* cross-site request forgery (CSRF),
* etc.

And, many more attacks are pre through hardening.

Tested on XAMPP for Windows v7.4.3 (64-bit) with Chrome v104.0.5112.102 (64-bit) and Firefox v104.0 (64-bit).

Made for educational purposes. I hope it will help!

How to Run

Import \\db\\secure_website.sql to your database server.

Copy all the content from \\src\\ to your server's web root directory (e.g. to \\xampp\\htdocs\\ on XAMPP).

Change the database settings inside \\src\\php\\config.ini as necessary.

Check the sign in credentials here.

Na to the website with your preferred web browser.

---

On web servers other than XAMPP (Apache) you might need to load Multibyte String librabry in PHP.

In XAMPP it is as simple as uncommenting extension=mbstring in php.ini.

Apache Hardening

From your Apache directory, open \conf\httpd.conf:

Disable HTTP TRACE method. Na to Supplemental configuration section and add new configuration TraceEnable Off.

Prevent directory listing. Na to DocumentRoot section and remove Indexes from Options Indexes FollowSymLinks Includes ExecCGI.

Prevent clickjacking attacks. Na to Supplemental configuration section and add new configuration Header always set X-Frame-Options "DENY".

Set Content Security Policy (CSP). The following configuration will only allow you to load resources from your own domain. Na to Supplemental configuration section and add new configuration Header always set Content-Security-Policy "default-src 'self'". Search the Internet for more Content Security Policy options. Check CSP here.

Block MIME sniffing. Na to Supplemental configuration section and add new configuration Header always set X-Content-Type-Options "nosniff".

Enforce cross-site scripting (XSS) filter. Na to Supplemental configuration section and add new configuration Header always set X-XSS-Protection "1; mode=block".

Prevent cross-site request forgery. The following configuration will not allow request from other websites (i.e. cross-site request). Na to Supplemental configuration section and add new configurations Header always set Access-Control-Allow-Origin " - where is your own domain name.

Set rate limiting. This is more of a denial-of-service (DoS) protection. Comment out mod_ratelimit.so extension, and add the follow code to the end of the file (this is speed in KiB/s, not number of requests; this will also affect the page load speed):

---

From your Apache directory, open \conf\extra\httpd-autoindex.conf:

Prevent '/icons/' directory listing. Comment out Alias /icons/ "C:/xampp/apache/icons/".

---

From your Apache directory, open \conf\extra\httpd-default.conf:

Prevent disclosure. Set Ser to Prod and Ser to Off.

Mitigate Slow Loris and other DoS attacks. Lower Timeout to 60.

---

From your Apache directory, open \conf\extra\httpd-info.conf:

Disable '/ser' page. Comment out entire <Location /ser> element.

PHP Hardening

From your PHP directory, open php.ini:

Prevent disclosure. Set expose_php to Off.

Prevent display errors information disclosure. Set both display_errors and display_startup_errors to Off.

Set the correct server's timezone. Set both instances of date.timezone to your timezone. Search the Internet for a list of supported timezones in PHP.

Set the session cookie's name. Set session.name to your own desired value. In addition to this website, it is also set here.

Set the session cookie's lifetime. Set session.cookie_lifetime to your own desired value. In addition to this website, it is also set here.

Set the session cookie's HttpOnly flag. The following configuration will not allow client side scripts to access the session cookie. Set session.cookie_httponly to 1. In addition to this website, it is also set here.

Use strict session mode. Set session.use_strict_mode to 1.

Disable file uploads. Do the following only if your website does not utilize file uploads. Set file_uploads to Off.

Prevent remote file inclusion. Set allow_url_fopen to Off.

Disable dangerous PHP functions. Set disable_functions to eval;exec;shell_exec;curl_exec;passthru;system;proc_open;popen. Search the Internet for additional dangerous PHP functions.

SSL/TLS Certificate

Find out how to create an SSL/TLS certificate here.

Images

<p align="center"><img src=" alt="Home Page"></p>

<p align="center">Figure 1 - Home Page</p>

<p align="center"><img src=" alt="Registration"></p>

<p align="center">Figure 2 - Registration</p>

<p align="center"><img src=" alt="Users Table"></p>

<p align="center">Figure 3 - Users Table</p>

<p align="center"><img src=" alt="Responsi"></p>

<p align="center">Figure 4 - Responsi</p>

项目信息

开发语言：PHP

Star 数：23

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Secure website with a registration, sign in, session management, and CRUD controls.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。