Jun 12, 2009, 19:18 by Dynom
The talk was fairly low/mid level but had some nice reminders, the sessions part was a good addition.
Secure Programming with the Zend Framework
Stefan Esser (Jun 12, 2009)
Talk at Dutch PHP Conference 2009 (English - US)
The idea of that talk is to go through the classes of vulnerabilities or security problems that you usually need to take care of yourself and look at the Zend Framework to check what internal protection ZF offers and how they are used and what problems you still need to solve on your own.
Quicklink: http://joind.in/597
Comments
Jun 13, 2009, 08:33 by Anonymous
Missed the depth in this talk. A bit low level, in my opinion. Quite a few open doors.
Jun 13, 2009, 13:10 by lifeforms
I don't use the ZF app framework myself, but checked this presentation to see if there are some nice ideas to use. And there were. Amongst which the auto generated CSRF token in the form generator.
Actually a small question/side discussion gave me a good idea for auto-encoding strings in my own front-end framework.
So this was a nice update and pretty inspirational.
Jun 13, 2009, 22:09 by Miljar
I use ZF on a daily basis, and I was curious to see if and how I could improve my security. I was very surprised to see that I already use a lot of the suggested improvements. I liked the info on Zend_Session, and the Hash element to prevent CSRF. Quite obvious, the latter one, but so much forgotten...
Jun 15, 2009, 18:33 by rickw
Very interesting talk. I use ZF every day also and it was also reassuring to see that I am already doing (mostly) the things highlighted by Stefan here.
Was particularly interested in the CSRF examples.
Jun 15, 2009, 22:34 by Pelle
Most of the things you talked about, should be common knowledge to each webdeveloper. For the people that did not knew all the pitfalls: excellent talk. For the ones that did: mostly a good freshup.
Jun 12, 2009, 14:07 by hvdklauw
Some comments on the talk where a bit towards the obvious, but the part about how to setup Zend_Session was nice.
I was however wondering at the code example where the session was started, the exception caught and the session restarted. I think this can't be done, once destroy is called on a session, a flag is set that prevents it from being started again.