first commit
This commit is contained in:
@@ -0,0 +1,119 @@
|
||||
<?php
|
||||
/**
|
||||
* This file demonstrates how to use the Rememberme library.
|
||||
*
|
||||
* Some code (autoload, templating) is just simple boilerplate and no shining
|
||||
* example of how to write php applications.
|
||||
*
|
||||
* @author Gabriel Birke
|
||||
*/
|
||||
|
||||
require_once __DIR__.'/../vendor/autoload.php';
|
||||
|
||||
use Birke\Rememberme;
|
||||
|
||||
/**
|
||||
* Helper function for redirecting and destroying the session
|
||||
* @param bool $destroySession
|
||||
* @return void
|
||||
*/
|
||||
function redirect($destroySession=false) {
|
||||
if($destroySession) {
|
||||
session_regenerate_id(true);
|
||||
session_destroy();
|
||||
}
|
||||
header("Location: index.php");
|
||||
exit;
|
||||
}
|
||||
|
||||
// Normally you would store the credentials in a DB
|
||||
$username = "demo";
|
||||
$password = "demo";
|
||||
|
||||
// Initialize RememberMe Library with file storage
|
||||
$storagePath = dirname(__FILE__)."/tokens";
|
||||
if(!is_writable($storagePath) || !is_dir($storagePath)) {
|
||||
die("'$storagePath' does not exist or is not writable by the web server.
|
||||
To run the example, please create the directory and give it the
|
||||
correct permissions.");
|
||||
}
|
||||
$storage = new Rememberme\Storage\File($storagePath);
|
||||
$rememberMe = new Rememberme\Authenticator($storage);
|
||||
|
||||
// First, we initialize the session, to see if we are already logged in
|
||||
session_start();
|
||||
|
||||
if(!empty($_SESSION['username'])) {
|
||||
if(!empty($_GET['logout'])) {
|
||||
$rememberMe->clearCookie($_SESSION['username']);
|
||||
redirect(true);
|
||||
}
|
||||
|
||||
if(!empty($_GET['completelogout'])) {
|
||||
$storage->cleanAllTriplets($_SESSION['username']);
|
||||
redirect(true);
|
||||
}
|
||||
|
||||
// Check, if the Rememberme cookie exists and is still valid.
|
||||
// If not, we log out the current session
|
||||
if(!empty($_COOKIE[$rememberMe->getCookieName()]) && !$rememberMe->cookieIsValid()) {
|
||||
redirect(true);
|
||||
}
|
||||
|
||||
// User is still logged in - show content
|
||||
$content = tpl("user_is_logged_in");
|
||||
}
|
||||
// If we are not logged in, try to log in via Rememberme cookie
|
||||
else {
|
||||
// If we can present the correct tokens from the cookie, we are logged in
|
||||
$loginresult = $rememberMe->login();
|
||||
if($loginresult) {
|
||||
$_SESSION['username'] = $loginresult;
|
||||
// There is a chance that an attacker has stolen the login token, so we store
|
||||
// the fact that the user was logged in via RememberMe (instead of login form)
|
||||
$_SESSION['remembered_by_cookie'] = true;
|
||||
redirect();
|
||||
}
|
||||
else {
|
||||
// If $rememberMe returned false, check if the token was invalid
|
||||
if($rememberMe->loginTokenWasInvalid()) {
|
||||
$content = tpl("cookie_was_stolen");
|
||||
}
|
||||
// $rememberMe returned false because of invalid/missing Rememberme cookie - normal login process
|
||||
else {
|
||||
if(!empty($_POST)) {
|
||||
if($username == $_POST['username'] && $password == $_POST['password']) {
|
||||
session_regenerate_id();
|
||||
$_SESSION['username'] = $username;
|
||||
// If the user wants to be remembered, create Rememberme cookie
|
||||
if(!empty($_POST['rememberme'])) {
|
||||
$rememberMe->createCookie($username);
|
||||
}
|
||||
else {
|
||||
$rememberMe->clearCookie();
|
||||
}
|
||||
redirect();
|
||||
}
|
||||
else {
|
||||
$content = tpl("login", "Invalid credentials");
|
||||
}
|
||||
}
|
||||
else {
|
||||
$content = tpl("login");
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// template function for including content, nothing interesting
|
||||
function tpl($template, $msg="") {
|
||||
$fn = __DIR__ . DIRECTORY_SEPARATOR . "templates" . DIRECTORY_SEPARATOR . $template . ".php";
|
||||
if(file_exists($fn)) {
|
||||
ob_start();
|
||||
include $fn;
|
||||
return ob_get_clean();
|
||||
}
|
||||
else {
|
||||
return "Template $fn not found";
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,157 @@
|
||||
/* HTML5 ✰ Boilerplate */
|
||||
|
||||
html, body, div, span, object, iframe, h1, h2, h3, h4, h5, h6, p, blockquote, pre,
|
||||
abbr, address, cite, code, del, dfn, em, img, ins, kbd, q, samp,
|
||||
small, strong, sub, sup, var, b, i, dl, dt, dd, ol, ul, li,
|
||||
fieldset, form, label, legend, table, caption, tbody, tfoot, thead, tr, th, td,
|
||||
article, aside, canvas, details, figcaption, figure, footer, header, hgroup,
|
||||
menu, nav, section, summary, time, mark, audio, video {
|
||||
margin:0;
|
||||
padding:0;
|
||||
border:0;
|
||||
outline:0;
|
||||
font-size:100%;
|
||||
vertical-align:baseline;
|
||||
background:transparent;
|
||||
}
|
||||
article, aside, details, figcaption, figure, footer, header, hgroup, menu, nav, section {
|
||||
display:block;
|
||||
}
|
||||
nav ul { list-style:none; }
|
||||
blockquote, q { quotes:none; }
|
||||
blockquote:before, blockquote:after,
|
||||
q:before, q:after { content:''; content:none; }
|
||||
a { margin:0; padding:0; font-size:100%; vertical-align:baseline; background:transparent; }
|
||||
ins { background-color:#ff9; color:#000; text-decoration:none; }
|
||||
mark { background-color:#ff9; color:#000; font-style:italic; font-weight:bold; }
|
||||
del { text-decoration: line-through; }
|
||||
abbr[title], dfn[title] { border-bottom:1px dotted; cursor:help; }
|
||||
table { border-collapse:collapse; border-spacing:0; }
|
||||
hr { display:block; height:1px; border:0; border-top:1px solid #ccc; margin:1em 0; padding:0; }
|
||||
input, select { vertical-align:middle; }
|
||||
|
||||
|
||||
body { font:13px/1.231 sans-serif; *font-size:small; }
|
||||
select, input, textarea, button { font:99% sans-serif; }
|
||||
pre, code, kbd, samp { font-family: monospace, sans-serif; }
|
||||
|
||||
body, select, input, textarea { color: #444; }
|
||||
h1,h2,h3,h4,h5,h6 { font-weight: bold; }
|
||||
html { overflow-y: scroll; }
|
||||
|
||||
a:hover, a:active { outline: none; }
|
||||
a, a:active, a:visited { color: #607890; }
|
||||
a:hover { color: #036; }
|
||||
|
||||
ul, ol { margin-left: 1.8em; }
|
||||
ol { list-style-type: decimal; }
|
||||
|
||||
nav ul, nav li { margin: 0; }
|
||||
small { font-size: 85%; }
|
||||
strong, th { font-weight: bold; }
|
||||
td, td img { vertical-align: top; }
|
||||
sub { vertical-align: sub; font-size: smaller; }
|
||||
sup { vertical-align: super; font-size: smaller; }
|
||||
pre { padding: 15px; white-space: pre; white-space: pre-wrap; white-space: pre-line; word-wrap: break-word; }
|
||||
textarea { overflow: auto; }
|
||||
.ie6 legend, .ie7 legend { margin-left: -7px; }
|
||||
input[type="radio"] { vertical-align: text-bottom; }
|
||||
input[type="checkbox"] { vertical-align: bottom; }
|
||||
.ie7 input[type="checkbox"] { vertical-align: baseline; }
|
||||
.ie6 input { vertical-align: text-bottom; }
|
||||
label, input[type=button], input[type=submit], button { cursor: pointer; }
|
||||
button, input, select, textarea { margin: 0; }
|
||||
input:valid, textarea:valid { }
|
||||
input:invalid, textarea:invalid { border-radius: 1px; -moz-box-shadow: 0px 0px 5px red; -webkit-box-shadow: 0px 0px 5px red; box-shadow: 0px 0px 5px red; }
|
||||
.no-boxshadow input:invalid,
|
||||
.no-boxshadow textarea:invalid { background-color: #f0dddd; }
|
||||
|
||||
::-moz-selection{ background: #FF5E99; color:#fff; text-shadow: none; }
|
||||
::selection { background:#FF5E99; color:#fff; text-shadow: none; }
|
||||
a:link { -webkit-tap-highlight-color: #FF5E99; }
|
||||
|
||||
button { width: auto; overflow: visible; }
|
||||
.ie7 img { -ms-interpolation-mode: bicubic; }
|
||||
|
||||
.ir { display: block; text-indent: -999em; overflow: hidden; background-repeat: no-repeat; text-align: left; direction: ltr; }
|
||||
.hidden { display: none; visibility: hidden; }
|
||||
.visuallyhidden { position: absolute !important; clip: rect(1px 1px 1px 1px); clip: rect(1px, 1px, 1px, 1px); }
|
||||
.invisible { visibility: hidden; }
|
||||
.clearfix:before, .clearfix:after { content: "\0020"; display: block; height: 0; visibility: hidden; }
|
||||
.clearfix:after { clear: both; }
|
||||
.clearfix { zoom: 1; }
|
||||
|
||||
|
||||
/* Primary Styles
|
||||
Author:
|
||||
*/
|
||||
|
||||
|
||||
h1 {
|
||||
width:800px;
|
||||
margin:50px auto;
|
||||
text-align:center;
|
||||
font-size:200%;
|
||||
font-weight:bold;
|
||||
}
|
||||
|
||||
#main {
|
||||
width:800px;
|
||||
margin:50px auto;
|
||||
}
|
||||
|
||||
label {
|
||||
display:inline-block;
|
||||
width:8em;
|
||||
}
|
||||
|
||||
input {
|
||||
margin:5px;
|
||||
}
|
||||
|
||||
p {
|
||||
margin-bottom:1em;
|
||||
}
|
||||
|
||||
ol {
|
||||
margin-bottom:1em;
|
||||
padding-left:1.5em;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@media all and (orientation:portrait) {
|
||||
|
||||
}
|
||||
|
||||
@media all and (orientation:landscape) {
|
||||
|
||||
}
|
||||
|
||||
@media screen and (max-device-width: 480px) {
|
||||
|
||||
|
||||
/* html { -webkit-text-size-adjust:none; -ms-text-size-adjust:none; } */
|
||||
}
|
||||
|
||||
@media print {
|
||||
* { background: transparent !important; color: #444 !important; text-shadow: none !important; }
|
||||
a, a:visited { color: #444 !important; text-decoration: underline; }
|
||||
a:after { content: " (" attr(href) ")"; }
|
||||
abbr:after { content: " (" attr(title) ")"; }
|
||||
.ir a:after { content: ""; }
|
||||
pre, blockquote { border: 1px solid #999; page-break-inside: avoid; }
|
||||
thead { display: table-header-group; }
|
||||
tr, img { page-break-inside: avoid; }
|
||||
@page { margin: 0.5cm; }
|
||||
p, h2, h3 { orphans: 3; widows: 3; }
|
||||
h2, h3{ page-break-after: avoid; }
|
||||
}
|
||||
|
||||
@@ -0,0 +1,42 @@
|
||||
<?php
|
||||
// Include PHP before any content is generated to we can set cookies
|
||||
// Sets the $content variable with the dynamic page content
|
||||
include "./action.php";
|
||||
?>
|
||||
<!doctype html>
|
||||
|
||||
<!--[if lt IE 7 ]> <html lang="en" class="no-js ie6"> <![endif]-->
|
||||
<!--[if IE 7 ]> <html lang="en" class="no-js ie7"> <![endif]-->
|
||||
<!--[if IE 8 ]> <html lang="en" class="no-js ie8"> <![endif]-->
|
||||
<!--[if IE 9 ]> <html lang="en" class="no-js ie9"> <![endif]-->
|
||||
<!--[if (gt IE 9)|!(IE)]><!--> <html lang="en" class="no-js"> <!--<![endif]-->
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
|
||||
<title>Rememberme PHP library test</title>
|
||||
<meta name="author" content="Gabriel Birke">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<link rel="stylesheet" href="css/style.css?v=2">
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
<div id="container">
|
||||
<header>
|
||||
<h1>Rememberme PHP library test</h1>
|
||||
</header>
|
||||
|
||||
<div id="main">
|
||||
<?php
|
||||
// Output generated content
|
||||
echo $content;
|
||||
?>
|
||||
</div>
|
||||
|
||||
<footer>
|
||||
|
||||
</footer>
|
||||
</div> <!-- end of #container -->
|
||||
|
||||
</body>
|
||||
</html>
|
||||
+4
@@ -0,0 +1,4 @@
|
||||
<p class="error">Someone else has used your login information to acccess this page!<br>
|
||||
All sessions were logged out. <br>
|
||||
Please log in with your credentials and check your data.</p>
|
||||
<p><a href="index.php">To login form</a></p>
|
||||
@@ -0,0 +1,14 @@
|
||||
<?php if(!empty($msg)) echo "<p class='msg'>$msg</p>"; ?>
|
||||
|
||||
<p>This is the demo for logging in with the Rememberme Library. <br>
|
||||
You are seeing this form because you have no active "Remember me" cookie and no
|
||||
credentials stored in the session.
|
||||
</p>
|
||||
<p>Please log in with the username and password <em>demo</em></p>
|
||||
|
||||
<form method="post" action="index.php">
|
||||
<label for="username">User Name:</label> <input type="text" name="username" id="username"> <br>
|
||||
<label for="password">Password:</label> <input type="password" name="password" id="password"><br>
|
||||
<input type="checkbox" id="rememberme" value="1" name="rememberme"> Remember me <br>
|
||||
<input type="submit" value="Log me in">
|
||||
</form>
|
||||
+31
@@ -0,0 +1,31 @@
|
||||
<p>You are logged in as <strong><?php echo $_SESSION['username']; ?></strong></p>
|
||||
<p>Your session ID is <strong><?php echo session_id(); ?></strong></p>
|
||||
<?php if(!empty($_COOKIE['PHP_REMEMBERME'])): ?>
|
||||
<p>The remember me cookie is active.
|
||||
Cookie value is <code><?php echo $_COOKIE['PHP_REMEMBERME']; ?></code></p>
|
||||
<?php else: ?>
|
||||
<p>The remember me cookie is not active.</p>
|
||||
<?php endif; ?>
|
||||
<?php if(!empty($_SESSION['remembered_by_cookie'])): ?>
|
||||
<p>You were logged in with the "Remember me" cookie. In a real application
|
||||
you should ask the user for his credentials before allowing him anything
|
||||
"dangerous" like changing the login information, accessing sensitive data
|
||||
or making a payment.</p>
|
||||
<?php endif; ?>
|
||||
<p>If you want to test the warning when a possible identity theft is detected, try the following steps:</p>
|
||||
<ol>
|
||||
<li>Login to this page with a non-Firefox Browser. In the following steps I
|
||||
will call that browser "Chrome" :) <br>
|
||||
Make sure to check the "Remember me" checkbox when logging in.</li>
|
||||
<li>Copy the cookie value from above into the clipboard.</li>
|
||||
<li>Quit Chrome to end the session.</li>
|
||||
<li>Start Firefox and install the <a href="https://addons.mozilla.org/de/firefox/addon/6683/">Firecookie</a> extension if needed.</li>
|
||||
<li>Show this page. If you see this text, log out. You should see the login form.</li>
|
||||
<li>Create the <code>PHP_REMEMBERME</code> cookie with the value you copied.</li>
|
||||
<li>Refresh the page - you are now logged in and should see this text. You have stolen the login credential from Chrome!</li>
|
||||
<li>Start Chrome and try to show this page - you should get a warning instead of the login dialog.</li>
|
||||
<li>Refresh this page in Firefox - You are logged out.</li>
|
||||
</ol>
|
||||
<p><a href="index.php?logout=true">Log out in this browser window.</a></p>
|
||||
<p><a href="index.php?completelogout=true">Log out from <strong>all</strong>
|
||||
sessions in all browser windows where the "Remember me" cookie is active.</a></p>
|
||||
Reference in New Issue
Block a user