Web application security is not an option, but a necessity. Attacks are becoming increasingly sophisticated, and effective countermeasures require multi-layered defense. Our script implements a comprehensive security system based on the Defense in Depth principle. This means that even if an attacker overcomes one barrier, another will stand in their way.
Let's look at the key elements of our security system.
1. Application and Data-Level Protection
This is the first line of defense, blocking the most common attack vectors.
XSS (Cross-Site Scripting) Protection: All data output to the browser is escaped for special characters. This prevents malicious scripts from executing in the context of another user's browser, protecting their data and sessions.
SQL Injection Protection: All database queries are executed exclusively through parameterized Prepared Statements. This completely eliminates the possibility of spoofing SQL query logic via user input.
Clickjacking Protection: Prevents attacks where users are tricked into clicking on invisible or fake elements.
CSRF (Cross-Site Request Forgery) Checking: Unique CSRF tokens are used for all critical operations (password changes, form submissions). The server checks their validity before executing the action, ensuring that the request was initiated from a trusted page on our site.
2. Securing Uploaded Files
Uploading files is a critical vulnerability. We have implemented a multi-layered system of checks to prevent the download and execution of malicious content.
Whitelisted file type validation: Only files with certain, safe extensions (e.g., '.jpg', '.png', '.pdf') are allowed to be uploaded. Both the extension and MIME type are checked.
Magic number (signature) check: The file is checked to ensure its actual content matches the declared type. This prevents scripts (e.g., '.php') from disguising themselves as images (by changing the extension to '.jpg').
Unique file name generation: When saved to the server, the file is assigned a new, generated name, preventing attacks involving overwriting system files or executing files with pre-known names.
File size limit: Strict limits on the size of uploaded files are set to prevent DDoS attacks and disk space overflows.
3. Resistance to Brute-Force Attacks and Unauthorized Access
These measures are aimed at countering automated attacks and direct hacking attempts.
Protection against brute-force attacks: A system for temporarily blocking an account or IP address after several unsuccessful login attempts has been implemented. This significantly increases the difficulty of brute-forcing credentials, making the attack impractical.
Protection against brute-forcing authentication via session cookies: Session identifiers are generated using cryptographically strong algorithms and have sufficient entropy, making them resistant to simple brute-force attacks.
4. Security of the Administrative Panel
The admin panel is a prime target for attackers, so its security is enhanced with additional measures.
Change the admin panel path: Standard paths like '/admin' have been changed to unique ones known only to authorized personnel. This effectively protects against attacks targeting vulnerabilities in popular management systems.
Change the login address: In addition to changing the path, the login URL can be further obscured, making life more difficult for automated scanners and scripts.
Two-factor authentication (2FA): Access to the admin panel requires not only a password but also a one-time code from email or Telegram. This means that even if the password is compromised, an attacker will not be able to gain access.
Allow authorization from specific IP addresses: Access to administrative functions is permitted only from a pre-approved list of IP addresses (e.g., the office network). This mitigates the risk of external access, even if credentials are stolen.
5. Session and User Data Protection
The goal is to ensure the confidentiality and integrity of user data at all stages.
Data Encryption in the Database: Sensitive information (e.g., personal data, tokens) is stored in the database in encrypted form. Even in the event of a database leak, this information will remain inaccessible without the encryption key.
Secure Cookies: All critical cookies (especially session cookies) have the following attributes:
- 'Secure' — cookies are transmitted only over a secure HTTPS connection.
- 'HttpOnly' — blocks access to cookies from JavaScript, protecting against attacks.XSS vulnerabilities.
- 'SameSite' — prevents sending cookies with cross-site requests, strengthening protection against CSRF.
Session binding to IP and User-Agent: Each user session is bound to the IP address and the browser's 'User-Agent' header. If these change, the session becomes invalid, and the user must log in again. This prevents the use of a stolen session cookie from another device or network.
Session encryption: Session data is stored encrypted on the server, protecting it from unauthorized reading if the server is compromised.
Conclusion
The presented security system is not a static set of rules. It is a dynamic, multi-layered shield that is constantly evolving.
XSS/SQL injection protection ensures code and data integrity.
Uploadable file protection prevents one of the most dangerous attack vectors.
Brute-force blocking and session stickiness make unauthorized access extremely difficult.
Hiding and enhanced authentication in the admin panel protect the most valuable segment.
Data encryption and secure cookies guarantee the confidentiality of information both in storage and during transmission.
This comprehensive approach, which now includes reliable protection against malicious files, ensures a high level of security for scripts and user data, in line with the best practices of modern web development. Security is a process, and we continue to work to strengthen it.
