PHP download

Download the PHP package vercodea/auth-core without Composer

On this page you can find all versions of the php package vercodea/auth-core. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

Table of contents
Download vercodea/auth-core
More information about vercodea/auth-core
Files in vercodea/auth-core

Vendor vercodea
Package auth-core
Short Description Enterprise-grade authentication system with rate limiting (IP + user), VPN/proxy detection, pipeline access locking, CSRF protection, secure session management, OTP verification, magic link recovery, password strength validation, common/reserved password blocklists, and SQL injection prevention.
License MIT

Keywords php security Authentication login session auth otp csrf rate-limit password-strength vpn-detection proxy-detection magic-link pipeline-lock

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:

If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.

Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
To use Composer is sometimes complicated. Especially for beginners.
Composer needs much resources. Sometimes they are not available on a simple webspace.
If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.

Please rate this library. Is it a good library?

Example code of vercodea/auth-core

Informations about the package auth-core

Vercodea Auth Core

🔐 Enterprise-grade PHP authentication system with advanced security features, rate limiting, OTP verification, and magic link recovery.

⚡ 100% Plug and Play - Install → Configure → Initialize → Done. Everything is automated.

📋 Table of Contents

Features
Requirements
Installation - 4 simple steps, fully automated
Configuration
Quick Start
API Reference
Security Features
Activity Logging
Database Schema
Best Practices
Troubleshooting
License
Support this project

✨ Features

🔒 bcrypt Password Hashing - Industry-standard password encryption with PASSWORD_DEFAULT algorithm
🛡️ Dual-Layer Rate Limiting - IP-based and user-based throttling to prevent brute force attacks
🌐 VPN/Proxy Detection - Real-time detection via ProxyCheck.io API with automatic blocking
📧 OTP Verification - 6-digit time-limited one-time passwords via email (Resend API)
🔑 Magic Link Recovery - Secure password recovery with unique tokens and expiration
🍪 Secure Session Management - Redis-backed sessions with CSRF protection and HttpOnly cookies
✅ Comprehensive Input Validation - Email, username, password, and OTP format validation
🚫 Common Password Blocklist - 94,500+ weak passwords prevented (+ reserved password list)
📝 Activity Logging - Audit trail for all authentication events with timestamps and user info
🔐 SQL Injection Prevention - 100% prepared statements via PDO
🚪 Pipeline Access Control - File-level security to prevent unauthorized direct execution
📬 HTML Email Templates - Beautiful, responsive email notifications for OTP, recovery, and account lockouts
🔔 Account Lockout Notifications - Automatic email alerts when suspicious activity detected
🌍 Multi-Environment Support - Development and production configurations

📦 Requirements

Component	Version	Purpose
PHP	7.4+ or 8.0+	Core runtime
MySQL	5.7+	User and session data storage
Redis	5.0+	Session, OTP, and rate limit caching
PHP Extensions	`pdo`, `redis`, `curl`, `openssl`, `json`	Required PHP modules
Composer	1.9+	Dependency manager

PHP Extensions Verification

🚀 Installation

Plug and Play Setup - Everything is automated. No manual SQL commands or database setup needed!

Step 1: Install via Composer

Step 2: Configure Environment

Edit .env and fill in your credentials:

All environment variables have secure defaults. See Configuration for complete list.

Step 3: Initialize Database (One-time)

That's it! All required tables are created automatically. No manual SQL commands needed.

Step 4: Start Using Authentication

⚙️ Configuration

Environment Variables Reference

Database Configuration

Variable	Default	Description
`MYSQL_HOST`	`127.0.0.1`	MySQL server hostname or IP
`MYSQL_PORT`	`3306`	MySQL server port
`MYSQL_USERNAME`	`root`	Database username
`MYSQL_PASSWORD`	``	Database password
`MYSQL_DBNAME`	``	Database name
`MYSQL_DIR_URL`	`null`	Unix socket path (optional)
`CHARSET`	`utf8mb4`	MySQL character set

Redis Configuration

Variable	Default	Description
`REDIS_HOST`	`127.0.0.1`	Redis server hostname
`REDIS_PORT`	`6379`	Redis server port
`REDIS_PASSWORD`	``	Redis password (optional)

Authentication Configuration

Variable	Default	Description
`OTP_EXPIRES`	`300`	OTP validity in seconds (5 min)
`OTP_VERIFICATION_ENABLED`	`true`	Enable/disable OTP verification requirement
`OTP_API_KEY`	``	Resend.com API key
`SEND_OTP_URL`	`https://api.resend.com/emails`	Email service endpoint
`DOMAIN`	`localhost`	Your application domain for emails

Rate Limiting Configuration

Variable	Default	Description
`MAX_ATTEMPTS`	`5`	Failed attempts before lockout
`PENALTY_PERIOD`	`60`	Lockout duration in seconds
`LIMIT_EXPIRES`	`3600`	Rate limit window in seconds (1 hour)

Session Configuration

Variable	Default	Description
`SESSION_EXPIRY`	`3600`	Session timeout in seconds (1 hour)
`SESSION_COOKIE_SECURE`	`false`	HTTPS only (set true in production)
`SESSION_COOKIE_HTTPONLY`	`true`	JavaScript access disabled
`SESSION_COOKIE_SAMESITE`	`Strict`	CSRF protection level
`SESSION_COOKIE_PATH`	`/`	Cookie path scope
`SESSION_COOKIE_DOMAIN`	``	Cookie domain (empty string = current domain)

Security Configuration

Variable	Default	Description
`APP_ENV`	`development`	Environment mode (production/development)
`CURLOPT_SSL_VERIFYPEER`	`false`	SSL verification for external APIs (true in production)
`LOG_DIR`	`./logs`	Application activity log directory
`ACCOUNT_RECOVERY_LIMIT_TIME`	`300`	Magic link validity in seconds (5 min)
`ACCOUNT_RECOVERY_SUBDOMAIN_PATH`	`http://localhost/recover`	Password recovery page URL

📧 Email Notification System

Vercodea Auth Core includes a comprehensive email notification system that automatically alerts users of important authentication events using beautifully designed HTML templates.

Email Templates

1. OTP Verification Email

Sent when users request OTP during registration or authentication.

Template: otp_code_msg.html
Contains: 6-digit OTP code, expiration time (5 min default)
Used by: auth_send_otp()

2. Password Recovery Email

Sent when users request account recovery via magic link.

Template: password_recovery.html
Contains: Secure recovery link with unique token and ID
Link format: {$reset_page}?token={$magic_token}&id={$magic_id}
Expiration: 5 minutes (configurable via ACCOUNT_RECOVERY_LIMIT_TIME)
Used by: auth_account_recovery_link()

3. Account Lockout Alert Email

Sent when suspicious activity is detected (too many failed login attempts).

Template: access_bridge_msg.html
Contains: IP address, timestamp, lockout duration
Includes: Security timeline showing LOCKED → COOLDOWN → UNLOCKED states
Used by: Rate limiter when max attempts exceeded

Email Configuration

All email sending is handled via the Resend API. Configure these environment variables:

Template Customization

To customize email templates:

Locate template files in: src/middleware/otp_manager/Otp_messages/messages/
Edit HTML templates (OTP variables use {$variable_name} syntax)
Available variables by template:
- otp_code_msg.html: {$otp_code}
- password_recovery.html: {$reset_url}
- access_bridge_msg.html: {$ip_address}, {$blocked_at}, {$block_expires}

🏗️ Architecture & Middleware

The system uses a middleware pipeline architecture with multiple security layers:

Middleware Stack

Middleware	Location	Purpose
Pipeline Gateway	`file_access_lock/gateway_locker.php`	File-level access control - prevents unauthorized direct execution
Network Check	`network_check.php`	VPN/Proxy detection via ProxyCheck.io API
Rate Limiter	`ratelimit.php`	IP-based and user-based throttling with account lockout
OTP Manager	`otp_manager/otp_mailer.php`	OTP generation, caching, and email delivery
Email OTP Verifier	`email_otp_verifier.php`	OTP validation and one-time use enforcement
Session Manager	`session_manager.php`	Secure Redis-backed session handling
Start System	`start_system.php`	System initialization and boot sequence

Request Flow

Pipeline Access Control (Security Feature)

The gateway_locker.php middleware enforces a whitelist of allowed entry points. Only authorized files can directly execute authentication code.

How it works:

Each authentication function verifies the caller is in the allowed files list
Unauthorized direct execution attempts are blocked with HTTP 403
Violations are logged for security audit

Example:

🎯 Quick Start

Here's a complete guide showing ALL 7 public methods in a real-world workflow:

📚 All Public Methods Reference

#	Method	Parameters	Returns	Purpose
1	`init()`	None	`void`	Initialize database (one-time setup)
2	`auth_send_otp(email)`	`$email: string`	`['status' => bool, 'msg' => string]`	Send OTP to email
3	`auth_register(name, username, email, password, otp_input)`	5 params	`['status' => bool, 'msg' => string]`	Register new user
4	`auth_login(username, email, password)`	3 params	`['status' => bool, 'msg' => string]`	Login user
5	`auth_logout()`	None	`['status' => bool, 'msg' => string]`	Logout user
6	`auth_account_recovery_link(email)`	`$email: string`	`['status' => bool, 'msg' => string]`	Send recovery link
7	`auth_verify_recovery(id, token, password, confirm)`	4 params	`['status' => bool, 'msg' => string]`	Reset password

✅ Response Format

All methods (except init()) return a standardized response:

Always check $result['status'] before proceeding:

📚 API Reference

AuthInit Class - All Public Methods

The AuthInit class provides 7 public methods for complete authentication workflow:

1. Initialize Database

Initializes the database by creating all required tables. Run this once during installation.