Secure Authentication

<?php
// SIKKER KODE - Best practices for secure authentication

// 1. Sikker session configuration
ini_set('session.cookie_httponly', 1);
ini_set('session.cookie_secure', 1);
ini_set('session.cookie_samesite', 'Strict');
ini_set('session.use_strict_mode', 1);
ini_set('session.use_only_cookies', 1);
ini_set('session.cookie_lifetime', 0); // Session cookie

session_start();

// 2. HTTPS enforcement
if (!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] !== 'on') {
    header('Location: https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);
    exit;
}

// 3. Sikker user registration med password hashing
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['register'])) {
    $username = trim($_POST['username'] ?? '');
    $password = $_POST['password'] ?? '';
    $email = trim($_POST['email'] ?? '');
    
    // Validér password strength
    if (strlen($password) < 12) {
        die("Password must be at least 12 characters");
    }
    
    if (!preg_match('/[A-Z]/', $password) || 
        !preg_match('/[a-z]/', $password) || 
        !preg_match('/[0-9]/', $password) || 
        !preg_match('/[^A-Za-z0-9]/', $password)) {
        die("Password must contain uppercase, lowercase, numbers, and special characters");
    }
    
    // Check for common passwords
    $common_passwords = ['Password123!', 'Welcome123!', 'Admin123!'];
    if (in_array($password, $common_passwords, true)) {
        die("Password is too common");
    }
    
    // Hash password med bcrypt (default) eller Argon2
    $hashed_password = password_hash($password, PASSWORD_ARGON2ID, [
        'memory_cost' => 65536,
        'time_cost' => 4,
        'threads' => 3
    ]);
    
    // Prepared statement for at forhindre SQL injection
    $stmt = $pdo->prepare("INSERT INTO users (username, email, password, created_at) VALUES (?, ?, ?, NOW())");
    
    try {
        $stmt->execute([$username, $email, $hashed_password]);
        echo "Registration successful";
    } catch (PDOException $e) {
        // Generisk fejlmeddelelse - afslør ikke specifik årsag
        error_log("Registration error: " . $e->getMessage());
        die("Registration failed. Please try again.");
    }
}

// 4. Sikker login med rate limiting
class RateLimiter {
    private $pdo;
    
    public function __construct($pdo) {
        $this->pdo = $pdo;
    }
    
    public function checkRateLimit($identifier, $max_attempts = 5, $window = 900) {
        $stmt = $this->pdo->prepare(
            "SELECT COUNT(*) FROM login_attempts 
             WHERE identifier = ? AND attempt_time > DATE_SUB(NOW(), INTERVAL ? SECOND)"
        );
        $stmt->execute([$identifier, $window]);
        $attempts = $stmt->fetchColumn();
        
        return $attempts < $max_attempts;
    }
    
    public function logAttempt($identifier) {
        $stmt = $this->pdo->prepare(
            "INSERT INTO login_attempts (identifier, attempt_time) VALUES (?, NOW())"
        );
        $stmt->execute([$identifier]);
    }
}

$rateLimiter = new RateLimiter($pdo);

if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['login'])) {
    $username = trim($_POST['username'] ?? '');
    $password = $_POST['password'] ?? '';
    $ip_address = $_SERVER['REMOTE_ADDR'];
    
    // Rate limiting check
    if (!$rateLimiter->checkRateLimit($ip_address)) {
        http_response_code(429);
        die("Too many login attempts. Please try again later.");
    }
    
    // Hent bruger fra database
    $stmt = $pdo->prepare("SELECT id, username, password, mfa_secret, account_locked FROM users WHERE username = ?");
    $stmt->execute([$username]);
    $user = $stmt->fetch(PDO::FETCH_ASSOC);
    
    // Timing-safe comparison
    $login_successful = false;
    
    if ($user && !$user['account_locked']) {
        if (password_verify($password, $user['password'])) {
            $login_successful = true;
        }
    }
    
    if (!$login_successful) {
        // Log failed attempt
        $rateLimiter->logAttempt($ip_address);
        
        // Generisk fejlmeddelelse
        sleep(2); // Delay for at gøre brute force langsommere
        die("Invalid credentials");
    }
    
    // Check om password skal rehashes (f.eks. hvis algoritme opdateres)
    if (password_needs_rehash($user['password'], PASSWORD_ARGON2ID)) {
        $new_hash = password_hash($password, PASSWORD_ARGON2ID);
        $stmt = $pdo->prepare("UPDATE users SET password = ? WHERE id = ?");
        $stmt->execute([$new_hash, $user['id']]);
    }
    
    // Regenerer session ID for at forhindre session fixation
    session_regenerate_id(true);
    
    // Sæt session variables
    $_SESSION['user_id'] = $user['id'];
    $_SESSION['username'] = $user['username'];
    $_SESSION['login_time'] = time();
    $_SESSION['ip_address'] = $ip_address;
    
    // Log successful login
    $stmt = $pdo->prepare(
        "INSERT INTO login_log (user_id, ip_address, login_time) VALUES (?, ?, NOW())"
    );
    $stmt->execute([$user['id'], $ip_address]);
    
    echo "Login successful";
}

// 5. Sikker logout
if (isset($_GET['logout'])) {
    // Invalidér session data
    $_SESSION = [];
    
    // Slet session cookie
    if (isset($_COOKIE[session_name()])) {
        setcookie(session_name(), '', time() - 3600, '/');
    }
    
    // Destroy session
    session_destroy();
    
    header('Location: /login.php');
    exit;
}

// 6. Session timeout check
if (isset($_SESSION['user_id'])) {
    $timeout = 1800; // 30 minutter
    
    if (isset($_SESSION['login_time']) && (time() - $_SESSION['login_time'] > $timeout)) {
        // Session expired
        session_unset();
        session_destroy();
        header('Location: /login.php?timeout=1');
        exit;
    }
    
    // Opdater login time for aktivitet
    $_SESSION['login_time'] = time();
}
?>