Security Guide

// Cookie name
session_name('clientra_session');

// Security flags
session_set_cookie_params([
  'lifetime' => 0,          // Session cookie (expires on browser close)
  'path'     => '/',
  'secure'   => true,      // HTTPS only
  'httponly' => true,      // Not accessible via JavaScript
  'samesite' => 'Lax'      // CSRF protection on cross-site requests
]);

// api.php — All endpoints go through this check
if (!isset($_SESSION['user_id']) || !$_SESSION['user_id']) {
  http_response_code(401);
  echo json_encode([
    'success' => false,
    'message' => 'Unauthorized'
  ]);
  exit();
}

// Generating a CSRF token
if (!isset($_SESSION['csrf_token'])) {
  $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}

// Validating on POST requests
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
  $token = $data['csrf_token'] ?? $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
  if (!hash_equals($_SESSION['csrf_token'], $token)) {
    http_response_code(403);
    echo json_encode(['success' => false, 'message' => 'CSRF token invalid']);
    exit();
  }
}

// RBACService — checking permissions
$rbac = new RBACService($pdo);

// Check if current user can perform action on module
if (!$rbac->can($_SESSION['user_id'], 'leads', 'delete')) {
  http_response_code(403);
  echo json_encode(['success' => false, 'message' => 'Permission denied']);
  exit();
}

// Check if user has admin role
if (!$rbac->isAdmin($_SESSION['user_id'])) {
  // Restrict to admin-only action
}

$validator = new Validator($data);

$validator->required(['name', 'phone'])
           ->email('email')
           ->maxLength('name', 150)
           ->numeric('price')
           ->in('status', ['New', 'Contacted', 'Won']);

if (!$validator->passes()) {
  echo json_encode([
    'success' => false,
    'message' => 'Validation failed',
    'errors'  => $validator->errors()
  ]);
  exit();
}

// CORRECT — Prepared statement
$stmt = $pdo->prepare(
  "SELECT * FROM leads WHERE id = ? AND assigned_to = ?"
);
$stmt->execute([$leadId, $_SESSION['user_id']]);

// WRONG — Never do this (SQL injection risk)
$pdo->query("SELECT * FROM leads WHERE id = $leadId"); // VULNERABLE!

// Allowed MIME types — always validate, never trust file extension alone
$allowedMimes = [
  'image/jpeg', 'image/png', 'image/gif', 'image/webp',
  'application/pdf',
  'application/msword',
  'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
  'application/vnd.ms-excel',
  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'
];

// Validate actual MIME type using finfo
$finfo = new finfo(FILEINFO_MIME_TYPE);
$mime = $finfo->file($_FILES['file']['tmp_name']);

if (!in_array($mime, $allowedMimes)) {
  throw new Exception('Invalid file type');
}

// Store with random filename — never use original filename
$filename = bin2hex(random_bytes(16)) . '.' . $ext;

// How email passwords are encrypted (simplified)
function encryptPassword($password, $key) {
  $iv = openssl_random_pseudo_bytes(16);
  $encrypted = openssl_encrypt($password, 'AES-256-CBC', $key, 0, $iv);
  return base64_encode($iv . $encrypted);
}

# Disable directory listing
Options -Indexes

# Prevent access to hidden files (.env, .git, etc.)
<FilesMatch "^\.">
  Require all denied
</FilesMatch>

# Only allow GET/POST (no DELETE, PATCH, OPTIONS from browser)
<LimitExcept GET POST>
  Require all denied
</LimitExcept>

# Security headers
Header always set X-Content-Type-Options nosniff
Header always set X-Frame-Options SAMEORIGIN
Header always set X-XSS-Protection "1; mode=block"
Header always set Referrer-Policy strict-origin-when-cross-origin