php-auth-config-audit

PHP Authentication Configuration and Logic Vulnerability Source Code Audit

This skill focuses on authentication, authorization, configuration, cryptography, and business logic flaws at the source code level. Runtime exploitation (such as JWT forgery, race condition scripts) falls under the corresponding black-box exploit skill scope.

In-depth Reference

• Dangerous patterns / secure pattern code comparison / detection methods for 5 risk categories → references/auth-config-patterns.md

---

5 Risk Categories Quick Reference Table

Type	Typical Pattern	Danger Signal	Severity
Authentication Bypass	Hardcoded credentials,== weak comparison, JWT algorithm none	Login/token verification logic	Critical-High
Authorization Out of Control	IDOR direct reference, missing ownership check, middleware skip	Resource access without permission verification	High-Critical
Security Configuration	display_errors=On、CORS *, debug mode residue	Information disclosure/cross-origin abuse	Medium-High
Cryptographic Misuse	md5($pass), ECB mode, hardcoded key	Password storage/encryption and decryption logic	High-Critical
Business Logic	Race condition, controllable payment amount, state machine step skipping	Transaction/inventory/state transition	High-Critical

Authentication Audit Key Points

• Hardcoded password/API Key: Search for password/secret/api_key/token locations assigned a literal string
• Weak comparison: == Comparing passwords/tokens causes type confusion ("0e123" == "0e456" is true), must use === or hash_equals
• JWT flaws: algorithm confusion (RS256→HS256), signature not verified,alg:none accepted, key leakage,kid parameter injection
• Remember Me: whether token is predictable (md5(username.time())), whether bound to user/device
• Password reset: token predictability, whether token is bound to the target user, whether there is an expiration mechanism

Authorization Audit Key Points

• IDOR: $_GET['id'] Direct query without WHERE user_id= ownership check, object reference can be tampered horizontally
• Route-level vs function-level permissions: whether middleware mounting scope fully covers, whether there are unprotected routes
• Middleware skip: route group omission,withoutMiddleware abuse, OPTIONS preflight bypass
• Horizontal privilege escalation vs vertical privilege escalation: Horizontal — same role accessing others' resources; Vertical — low privilege accessing high privilege functionality

Configuration Audit Key Points

• Error exposure: display_errors=On + error_reporting=E_ALL leaking path/SQL/stack information
• CORS: Access-Control-Allow-Origin: * combined with Allow-Credentials: true allowing arbitrary origins to carry credentials
• Debug mode: Laravel APP_DEBUG=true、ThinkPHP app_debug, custom DEBUG constant residue
• Missing security headers: X-Frame-Options、Content-Security-Policy、X-Content-Type-Options not set

Cryptography Audit Key Points

• Weak hash: md5($pass) / sha1($pass) used for password storage, should use password_hash(PASSWORD_BCRYPT)
• ECB mode: Deterministic encryption, identical plaintext produces identical ciphertext, content can be analyzed and inferred
• Hardcoded keys: KEY/IV/SECRET Hardcoded in source code, search openssl_encrypt/mcrypt_* key sources of calls
• Weak random numbers: mt_rand/rand/uniqid Used to generate security tokens, should use random_bytes/random_int

Logic audit key points

• Race conditions: Balance/inventory checked before deduction without transaction/lock (SELECT→UPDATE without FOR UPDATE）
• Payment amount tampering: Amount passed in from client rather than calculated server-side, missing signature verification
• State machine step skipping: Order status jumps directly from "pending payment" to "shipped", missing state transition validity validation
• Unrestricted batch operations: No rate limiting/no quantity cap, can be abused for batch operations

Detection checklist

• Hardcoded credential search completed (password/secret/key/token/api_key)
• All == locations comparing passwords/tokens have been marked
• JWT signature verification logic reviewed (algorithm, key source, kid)
• IDOR risk points checked for ownership validation
• Route permission coverage completeness verified
• php.ini / framework configuration security baseline compared
• Password storage method confirmed (password_hash vs md5/sha1)
• Encryption key management method reviewed (hardcoded vs environment variables/key management)
• Race condition sensitive operations checked for transaction/lock mechanisms
• Amount source and signature verification of payment/transaction flows confirmed