You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+89-23Lines changed: 89 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,11 +1,60 @@
1
1
# U2F-php-server
2
-
Server-side handling of FIDO U2F registration and authentication for PHP
3
-
2
+
Server-side handling of FIDO U2F registration and authentication for PHP.
3
+
4
+
Securing your online accounts and doing your bit to protect your data is extremely important and increasingly more so as hackers get more sophisticated.
5
+
FIDO's U2F enables you to add a simple unobtrusive method of 2nd factor authentication, allowing users of your service and/or application to link a hardware key to their account.
1.[Registration Process Flow](#registration-process-flow)
18
+
1.[Authentication Process Flow](#authentication-process-flow)
19
+
6.[Example Code](#example-code)
20
+
1.[Registration Code](#registration-code)
21
+
1.[Authentication Code](#authentication-code)
22
+
7.[Frameworks](#frameworks)
23
+
1.[Laravel](#laravel-framework)
24
+
1.[Yii](#yii-framework)
25
+
1.[CodeIgniter](#codeigniter-framework)
26
+
8.[Licence](#licence)
27
+
9.[Credits](#credits)
4
28
5
29
## Installation
6
30
7
31
`composer require samyoul/u2f-php-server`
8
32
33
+
## Requirements
34
+
35
+
A few **things you need** to know before working with this:
36
+
37
+
1.[**_OpenSSL_**](#openssl)
38
+
2.[**_A Datastore_**](#recommended-datastore-structure) You need some kind of datastore for all your U2F registered users (although if you have a system with user authentication I'm presuming you've got this one sorted).
39
+
3.[**_Client-side Handling_**](#client-side) You need to be able to communicate with a some kind of device.
40
+
4.[**_A HTTPS URL_**](#https-and-ssl) This is very important, without HTTPS Chrome will refuse to communicate with you.
41
+
42
+
### OpenSSL
43
+
44
+
... Info about installing OpenSSL ...
45
+
46
+
### Client-side (The magic JavaScript Bit of talking with a USB device)
47
+
48
+
My presumption is that if you are looking to add U2F authentication to a php system, then you'll probably are also looking for some client-side handling. You've got a U2F enabled USB device and you want to get the USB device speaking with the browser and then with your server running php.
49
+
50
+
1. Google already have this bit sorted : https://github.com/google/u2f-ref-code/blob/master/u2f-gae-demo/war/js/u2f-api.js
51
+
2.[Mastahyeti](https://github.com/mastahyeti) has created a repo dedicated to Google's JavaScript Client-side API : https://github.com/mastahyeti/u2f-api
52
+
53
+
### HTTPS and SSL
54
+
55
+
Without a HTTPS URL your code won't work, so get one for your localhost, get one for your production. https://letsencrypt.org/
56
+
57
+
9
58
## Terminology
10
59
11
60
**_HID_** : _Human Interface Device_, like A USB Device [like these things](https://www.google.co.uk/search?q=fido+usb+key&safe=off&tbm=isch)
@@ -26,32 +75,13 @@ You don't need to follow this structure exactly, but you will need to associate
26
75
27
76
TODO the descriptions
28
77
29
-
## Things You Need
30
-
31
-
A few **things you need** to know before working with this:
32
-
33
-
1.**_A Datastore._** You need some kind of datastore for all your U2F registered users (although if you have a system with user authentication I'm presuming you've got this one sorted).
34
-
2.**_Client-side Handling._** You need to be able to communicate with a some kind of device. I've got help for this [here](#client-side)
35
-
3.**_A HTTPS URL._** This is very important, without HTTPS Chrome will refuse to communicate with you. [See here](#https-and-ssl)
36
-
37
-
### Client-side (The magic JavaScript Bit of talking with a USB device)
38
-
39
-
My presumption is that if you are looking to add U2F authentication to a php system, then you'll probably are also looking for some client-side handling. You've got a U2F enabled USB device and you want to get the USB device speaking with the browser and then with your server running php.
40
-
41
-
1. Google already have this bit sorted : https://github.com/google/u2f-ref-code/blob/master/u2f-gae-demo/war/js/u2f-api.js
42
-
2.[Mastahyeti](https://github.com/mastahyeti) has created a repo dedicated to Google's JavaScript Client-side API : https://github.com/mastahyeti/u2f-api
43
-
44
-
### HTTPS and SSL
45
-
46
-
Without a HTTPS URL your code won't work, so get one for your localhost, get one for your production. https://letsencrypt.org/
47
-
48
78
## Process Workflow
49
79
50
-
### Registration Process flow
80
+
### Registration Process Flow
51
81
52
82
1. User navigates to a 2nd factor authentication page in your application.
53
83
54
-
### Authentication Process flow
84
+
### Authentication Process Flow
55
85
56
86
1. User navigates to their login page as they usually would, submits username and password.
57
87
2. Server received POST request authentication data, normal username + password validation occurs
@@ -71,6 +101,12 @@ Without a HTTPS URL your code won't work, so get one for your localhost, get one
71
101
72
102
## Example Code
73
103
104
+
For a full working example of this repository please see [the dedicated example repository](https://github.com/Samyoul/U2F-php-server-examples)
0 commit comments