Download the PHP package psecio/uri without Composer
On this page you can find all versions of the php package psecio/uri. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Package uri
Short Description A secure URI generation and validation library
License MIT
Homepage https://github.com/psecio/uri.git
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package uri
Psecio\Uri
A common attack method that pentesters and actual attackers will use is to capture a URL with "id" values in it (like /user/view?id=1234 where 1234 is an ID) and manually change this value to try to bypass authorization checks. While an application should always have some kind of auth check when the URL is called, there's another step that can help to prevent URL changes: a signature value.
This signature value is built using the contents of the current URL along with a "secret" value unique to the application. This signature is then appended to the URL and can be used directly in links. When the URL is used and the request is received, the signature is then checked against the current URL values. If there's no match, the check fails.
Installation
Installing via Composer is simple:
This package only has one dependency, PHPUnit, and that's only a development dependency.
Signing URLs
In this example we've created a new Builder instance, loaded with the secret value, and are using it to create the URL based on the data and URL provided. The $url result has the signature value appended to the URL. This value can then be used directly.
You can also add a signature to a currently existing URL that already has URL parameters using the same create method:
Verifying URLs
The other half of the equation is the verification of a URL. The library provides the validate method to help with that:
Expiring URLs
The library also provides the ability to create URLs that will fail validation because they've expired. To make use of this, simply pass in a third value for the create method call. This value should either be the number of seconds or a relative string (parsable by PHP's strtotime) of the amount of time to add:
You'll notice the addition of a new URL parameter, the expires value. This value is automatically read when the validate call is made to ensure the URL hasn't timed out. If it has, even if the rest of the data is correct, the result will be false.
Even if the attacker tries to update the expires date to try to extend the length of the hash, the validation will fail as that's not the expires value it was originally hashed with.
