codeigniter_tutorial

CodeIgniter
CSRF Prevention
CSRF stands for cross-site request forgery. You can prevent this attack by enabling it in
the application/config/config.php file as shown below.
$config['csrf_protection']=TRUE;
When you are creating form using form_open() function, it will automatically insert a
CSRF as hidden field. You can also manually add the CSRF using the
get_csrf_token_name() and get_csrf_hash() function. The
get_csrf_token_name() function will return the name of the CSRF and
get_csrf_hash() will return the hash value of CSRF.
The CSRF token can be regenerated every time for submission or you can also keep it
same throughout the life of CSRF cookie. By setting the value TRUE, in config array with
key ‘csrf_regenerate’ will regenerate token as shown below.
$config['csrf_regenerate']=TRUE;
You can also whitelist URLs from CSRF protection by setting it in the config array using
the key ‘csrf_exclude_uris’ as shown below. You can also use regular expression.
$config['csrf_exclude_uris']=array('api/person/add');
Password Handling
Many developers do not know how to handle password in web applications, which is
probably why numerous hackers find it so easy to break into the systems. One should
keep in mind the following points while handling passwords:
DO NOT store passwords in plain-text format.
Always hash your passwords.
DO NOT use Base64 or similar encoding for storing passwords.
DO NOT use weak or broken hashing algorithms like MD5 or SHA1. Only use
strong password hashing algorithms like BCrypt, which is used in PHP’s own
Password Hashing functions.
DO NOT ever display or send a password in plain-text format.
DO NOT put unnecessary limits on your users’ passwords.
90