feat: Implement secure authentication module and integrate session management across multiple files
This commit is contained in:
@@ -0,0 +1,286 @@
|
||||
<?php
|
||||
/**
|
||||
* Web & PC Studio - Beveiligd Inlogscherm
|
||||
* Server-side authenticatie voor server.webenpcstudio.nl met brute-force protectie.
|
||||
*/
|
||||
|
||||
require_once __DIR__ . '/auth.php';
|
||||
|
||||
// Als gebruiker al ingelogd is, direct doorsturen
|
||||
if (is_logged_in()) {
|
||||
header('Location: index.php');
|
||||
exit;
|
||||
}
|
||||
|
||||
$error = '';
|
||||
$lockoutTime = 300; // 5 minuten blokkade bij te veel pogingen
|
||||
|
||||
// Initialiseer rate limiting
|
||||
if (!isset($_SESSION['login_attempts'])) {
|
||||
$_SESSION['login_attempts'] = 0;
|
||||
$_SESSION['last_attempt_time'] = time();
|
||||
}
|
||||
|
||||
// Controleer of de gebruiker tijdelijk geblokkeerd is
|
||||
if ($_SESSION['login_attempts'] >= 5) {
|
||||
$timePassed = time() - $_SESSION['last_attempt_time'];
|
||||
if ($timePassed < $lockoutTime) {
|
||||
$remaining = ceil(($lockoutTime - $timePassed) / 60);
|
||||
$error = "Te veel mislukte inlogpogingen. Probeer het over {$remaining} minuten opnieuw.";
|
||||
} else {
|
||||
// Reset na verloop van blokkade
|
||||
$_SESSION['login_attempts'] = 0;
|
||||
}
|
||||
}
|
||||
|
||||
// Verwerk inlogverzoek
|
||||
if ($_SERVER['REQUEST_METHOD'] === 'POST' && empty($error)) {
|
||||
$csrfToken = $_POST['csrf_token'] ?? '';
|
||||
$username = trim($_POST['username'] ?? '');
|
||||
$password = $_POST['password'] ?? '';
|
||||
|
||||
// Kleine vertraging tegen timing-aanvallen
|
||||
usleep(200000);
|
||||
|
||||
if (!verify_csrf_token($csrfToken)) {
|
||||
$error = 'Beveiligingstoken (CSRF) ongeldig of verlopen. Ververs de pagina.';
|
||||
} else {
|
||||
// Vergelijk gebruikersnaam hash (timing-safe) en wachtwoord via bcrypt
|
||||
$userMatches = hash_equals(AUTH_USER_HASH, hash('sha256', strtolower($username)));
|
||||
$passMatches = password_verify($password, AUTH_PASS_HASH);
|
||||
|
||||
if ($userMatches && $passMatches) {
|
||||
// Sessie fixatie voorkomen via regeneratie
|
||||
session_regenerate_id(true);
|
||||
|
||||
$_SESSION['wpc_auth'] = true;
|
||||
$_SESSION['wpc_user_email'] = htmlspecialchars($username);
|
||||
$_SESSION['wpc_last_activity'] = time();
|
||||
$_SESSION['login_attempts'] = 0;
|
||||
|
||||
// Veilige doorverwijzing
|
||||
$redirect = $_GET['redirect'] ?? 'index.php';
|
||||
// Alleen relatieve redirects toestaan
|
||||
if (empty($redirect) || strpos($redirect, '://') !== false || strpos($redirect, '//') === 0) {
|
||||
$redirect = 'index.php';
|
||||
}
|
||||
|
||||
header("Location: {$redirect}");
|
||||
exit;
|
||||
} else {
|
||||
$_SESSION['login_attempts']++;
|
||||
$_SESSION['last_attempt_time'] = time();
|
||||
$attemptsLeft = max(0, 5 - $_SESSION['login_attempts']);
|
||||
$error = "Ongeldige gebruikersnaam of wachtwoord. (Nog {$attemptsLeft} pogingen)";
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
$csrfToken = get_csrf_token();
|
||||
$logoutMessage = isset($_GET['logout']) ? 'U bent succesvol en veilig uitgelogd.' : '';
|
||||
?>
|
||||
<!DOCTYPE html>
|
||||
<html lang="nl">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>Web & PC Studio - Beveiligde Toegang</title>
|
||||
<link rel="stylesheet" href="style.css">
|
||||
<script src="theme.js"></script>
|
||||
<style>
|
||||
body {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
min-height: 100vh;
|
||||
padding: 20px;
|
||||
}
|
||||
|
||||
.login-card {
|
||||
width: 100%;
|
||||
max-width: 440px;
|
||||
background: var(--bg-surface);
|
||||
backdrop-filter: blur(20px);
|
||||
-webkit-backdrop-filter: blur(20px);
|
||||
border: 1px solid var(--border-subtle);
|
||||
border-radius: var(--radius-xl);
|
||||
padding: 38px 32px;
|
||||
box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.6);
|
||||
text-align: left;
|
||||
}
|
||||
|
||||
.login-header {
|
||||
text-align: center;
|
||||
margin-bottom: 28px;
|
||||
}
|
||||
|
||||
.login-logo {
|
||||
background: linear-gradient(135deg, var(--primary), var(--accent));
|
||||
width: 52px;
|
||||
height: 52px;
|
||||
border-radius: 14px;
|
||||
display: flex;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
font-weight: 800;
|
||||
font-size: 1.5rem;
|
||||
color: white;
|
||||
box-shadow: 0 6px 20px var(--primary-glow);
|
||||
margin: 0 auto 16px;
|
||||
}
|
||||
|
||||
.login-title {
|
||||
font-size: 1.45rem;
|
||||
font-weight: 800;
|
||||
color: var(--text-main);
|
||||
margin-bottom: 6px;
|
||||
}
|
||||
|
||||
.login-subtitle {
|
||||
font-size: 0.85rem;
|
||||
color: var(--text-muted);
|
||||
}
|
||||
|
||||
.form-group {
|
||||
margin-bottom: 18px;
|
||||
}
|
||||
|
||||
.form-label {
|
||||
display: block;
|
||||
font-size: 0.82rem;
|
||||
font-weight: 600;
|
||||
color: var(--text-muted);
|
||||
margin-bottom: 6px;
|
||||
}
|
||||
|
||||
.input-wrap {
|
||||
position: relative;
|
||||
display: flex;
|
||||
align-items: center;
|
||||
}
|
||||
|
||||
.form-control {
|
||||
width: 100%;
|
||||
background: rgba(0, 0, 0, 0.35);
|
||||
border: 1px solid var(--border-subtle);
|
||||
border-radius: var(--radius-md);
|
||||
padding: 12px 14px;
|
||||
color: var(--text-main);
|
||||
font-size: 0.92rem;
|
||||
outline: none;
|
||||
transition: all 0.2s ease;
|
||||
}
|
||||
|
||||
[data-theme="light"] .form-control {
|
||||
background: rgba(241, 245, 249, 0.8);
|
||||
}
|
||||
|
||||
.form-control:focus {
|
||||
border-color: var(--primary);
|
||||
box-shadow: 0 0 0 3px var(--primary-glow);
|
||||
}
|
||||
|
||||
.toggle-pwd {
|
||||
position: absolute;
|
||||
right: 12px;
|
||||
background: transparent;
|
||||
border: none;
|
||||
color: var(--text-subtle);
|
||||
cursor: pointer;
|
||||
font-size: 1rem;
|
||||
padding: 4px;
|
||||
}
|
||||
|
||||
.alert-error {
|
||||
background: rgba(239, 68, 68, 0.12);
|
||||
border: 1px solid rgba(239, 68, 68, 0.3);
|
||||
color: #f87171;
|
||||
padding: 12px 14px;
|
||||
border-radius: var(--radius-md);
|
||||
font-size: 0.84rem;
|
||||
margin-bottom: 20px;
|
||||
}
|
||||
|
||||
.alert-success {
|
||||
background: rgba(16, 185, 129, 0.12);
|
||||
border: 1px solid rgba(16, 185, 129, 0.3);
|
||||
color: #34d399;
|
||||
padding: 12px 14px;
|
||||
border-radius: var(--radius-md);
|
||||
font-size: 0.84rem;
|
||||
margin-bottom: 20px;
|
||||
}
|
||||
|
||||
.login-footer {
|
||||
margin-top: 24px;
|
||||
padding-top: 18px;
|
||||
border-top: 1px solid var(--border-subtle);
|
||||
display: flex;
|
||||
justify-content: space-between;
|
||||
align-items: center;
|
||||
font-size: 0.78rem;
|
||||
color: var(--text-subtle);
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<div class="login-card">
|
||||
<!-- Logo & Header -->
|
||||
<div class="login-header">
|
||||
<div class="login-logo">🔒</div>
|
||||
<h1 class="login-title">Beveiligde Toegang</h1>
|
||||
<p class="login-subtitle">server.webenpcstudio.nl • Testdrive Hub</p>
|
||||
</div>
|
||||
|
||||
<?php if (!empty($logoutMessage)): ?>
|
||||
<div class="alert-success"><?= htmlspecialchars($logoutMessage); ?></div>
|
||||
<?php endif; ?>
|
||||
|
||||
<?php if (!empty($error)): ?>
|
||||
<div class="alert-error"><?= htmlspecialchars($error); ?></div>
|
||||
<?php endif; ?>
|
||||
|
||||
<!-- Formulier -->
|
||||
<form method="POST" action="">
|
||||
<input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrfToken); ?>">
|
||||
|
||||
<div class="form-group">
|
||||
<label class="form-label" for="username">Gebruikersnaam (E-mail):</label>
|
||||
<div class="input-wrap">
|
||||
<input type="email" id="username" name="username" class="form-control"
|
||||
placeholder="naam@domein.nl" required autofocus autocomplete="username">
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="form-group" style="margin-bottom: 24px;">
|
||||
<label class="form-label" for="password">Wachtwoord:</label>
|
||||
<div class="input-wrap">
|
||||
<input type="password" id="password" name="password" class="form-control"
|
||||
placeholder="••••••••••••" required autocomplete="current-password">
|
||||
<button type="button" class="toggle-pwd" onclick="togglePasswordVisibility()" title="Toon/verberg wachtwoord">👁️</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<button type="submit" class="btn btn-primary" style="width: 100%; padding: 12px; font-size: 0.95rem;">
|
||||
Inloggen op Server
|
||||
</button>
|
||||
</form>
|
||||
|
||||
<div class="login-footer">
|
||||
<span>TLS / SSL Beveiligd</span>
|
||||
<button class="btn btn-secondary btn-sm theme-btn" onclick="toggleTheme()" style="padding: 4px 8px;">🌙 Thema</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<script>
|
||||
function togglePasswordVisibility() {
|
||||
const pwdInput = document.getElementById('password');
|
||||
if (pwdInput.type === 'password') {
|
||||
pwdInput.type = 'text';
|
||||
} else {
|
||||
pwdInput.type = 'password';
|
||||
}
|
||||
}
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
Reference in New Issue
Block a user