Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Refactor Security Class #3961

Merged

Conversation

mostafakhudair
Copy link
Contributor

Creates new Config\Security class and make \CodeIgniter\Security\Security class depends on it

removes useless properties
rename some properties

rename some methods

CSRFVerify() to verify()
getCSRFHash() to getHash()
getCSRFTokenName() to getTokenName()
setHash() to generateHash()

add new public methods:

getHeaderName()
getCookieName()
isExpired()
shouldRedirect()

edits changes in user guide

  • Securely signed commits
  • Component(s) with PHPdocs
  • User guide updated
  • Conforms to style guide

Closes #3836

Copy link
Member

@paulbalandan paulbalandan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The refactor is good to me but we need the review of others since this is a major component of the framework. Some notes:

  • Fix the user guide syntax check
  • In the main Security class, you cannot rename or remove the public and protected methods as it would mean a BC break for people using those. The deprecations and detours for the renamed Security methods are good though.
  • See other comments below.

system/Config/Services.php Outdated Show resolved Hide resolved
system/Security/Security.php Outdated Show resolved Hide resolved
@MGatner
Copy link
Member

MGatner commented Dec 6, 2020

This looks great! I'm a fan of splitting these out, you've been doing a great job with it. I'd like to give this one more look when I'm not on mobile (or have someone else's review) but let's plan to include this in 4.1 so these deprecations can get entered.

@MGatner
Copy link
Member

MGatner commented Dec 6, 2020

Is there any merit to merging this and ContentSecurityPolicy config? I'm not terribly knowledgeable of the various security components but as a novice having all "security" under one Config seems logical?

@mostafakhudair
Copy link
Contributor Author

Is there any merit to merging this and ContentSecurityPolicy config? I'm not terribly knowledgeable of the various security components but as a novice having all "security" under one Config seems logical?

While ContentSecurityPolicy config serve HTTP\ContentSecurityPolicy class, and Security config serve Security\Security class, I think there is no point in merging them together at least for now.

@lonnieezell
Copy link
Member

I think this looks good also. @MGatner are we good to merge this into 4.0.5 or should this be a 4.1 change? It looks like everything is deprecated and BC safe.

@MGatner
Copy link
Member

MGatner commented Dec 8, 2020

@lonnieezell I think this is fine for 4.0.5. Since we decided to support PHP 8 in 4.0.5 the only real rubric for 4.1 is support for PHP 7.2.

@MGatner MGatner merged commit a2de1f6 into codeigniter4:develop Dec 8, 2020
@mostafakhudair mostafakhudair deleted the refactor-security-class branch December 8, 2020 17:21
@mostafakhudair mostafakhudair mentioned this pull request Dec 19, 2020
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants