Download the PHP package metaclass-nl/tresholds-governor without Composer
On this page you can find all versions of the php package metaclass-nl/tresholds-governor. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download metaclass-nl/tresholds-governor
More information about metaclass-nl/tresholds-governor
Files in metaclass-nl/tresholds-governor
Package tresholds-governor
Short Description Tresholds Governor, aims to facilitate the protection of authentication against brute force and dictionary attacks
License MIT
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package tresholds-governor
tresholds-governor
Tresholds Governor, aims to facilitate the protection of authentication against brute force and dictionary attacks
INTRODUCTION
The OWASP Guide states "Applications MUST protect credentials from common authentication attacks as detailed
in the Testing Guide". This library aims to protect user credentials from
these authentication attacks. It is based on the "Tresholds Governer" described in the OWASP Guide.
FEATURES
-
Framework-independent library to be used from Framework-specific bundle/component or from applications that implement their own authentication
-
Registers authentication counts and decides to Block by username or client ip address for which authentication failed too often,
-
To hide weather an account actually exists for a username, any username that is tried too often may be blocked, regardless of the existence and status of an account with that username,
-
Facilitates a logical difference between failed login lockout and eventual administrative lockout, so that re-enabling all usernames en masse does not unlock administratively locked users (OWASP requirement).
-
Automatic release of username on authentication success (optional),
- Stores counters instead of individual requests to prevent database flooding from brute force attacks.
REQUIREMENTS
PHP >=5.3.3,
PDO or Doctrine DBAL ^2.3.4 or custom implementations of the Management interfaces.
Tested with MySQL 5.5. and SQLite 3
RELEASE NOTES
This is a pre-release version under development.
May be vurnerable to enumeration of usernames through timing attacks because of differences in database query performance for frequently and infrequently used usernames. This can be mitigated by calling ::sleepUntilFixedExecutionTime. Under normal circomstances that should be sufficient if the fixedExecutionSeconds is set long enough, but under high (database) server loads when performance degrades, under specific conditons information may still be extractable by timing.
DOCUMENTATION
- Installation and configuration
- [Counting and deciding](doc/Counting and deciding.md)
SUPPORT
MetaClass offers help and support on a commercial basis with the application and extension of this bundle and additional security measures.
http://www.metaclass.nl/site/index_php/Menu/10/Contact.html
COPYRIGHT AND LICENCE
Unless notified otherwise Copyright (c) 2014 MetaClass Groningen
This bundle is under the MIT license. See the complete license in the bundle:
meta/LICENSETHE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
