Improve Authentication Security & Configuration

[devstygian]

Description

The current authentication system is working as a prototype, but there are several security and configuration issues that should be addressed before treating it as production-ready.

These fixes were intentionally deferred from the current prototype PR so they can be handled separately.

Tasks

Authentication Security

• Regenerate session ID after login

  • Add session_regenerate_id(true) after successful authentication.
  • Prevent session fixation attacks.

• Add CSRF protection

  • Add CSRF tokens to login and register forms.
  • Validate tokens server-side.
  • Change logout from GET to POST.
  • Protect other authentication-related POST requests where necessary.

• Validate Google's email_verified

  • Require Google's email_verified value to be true.
  • Do not treat a missing value as verified.
  • Review the Google account-linking flow while making this change.

🔧 Configuration & Error Handling

• Fix config.local.php loading

  • Make config.local.php optional.
  • Prevent errors when the file does not exist on a fresh clone.
  • Load local configuration before defining default values.
  • Allow local configuration values to override defaults.

• Hide raw database errors

  • Stop displaying raw database connection errors to users.
  • Log the actual error for debugging.
  • Display a generic error message to the user.

🧹 Additional Cleanup

• Review sanitize()

  • Separate input validation from HTML escaping.
  • Validate/normalize data before storing it.
  • Use HTML escaping when outputting data.

• Fix the Forgot Password link

  • Either implement reset-password.php
  • Or remove/disable the link until the feature exists.

Testing Checklist

After implementing the fixes:

• Normal login still works.
• Registration still works.
• Google login still works.
• Google callback still works.
• Logout works using POST.
• Invalid/missing CSRF tokens are rejected.
• Sessions are regenerated after successful login.
• Fresh clone works without config.local.php.
• Database errors are not exposed to users.
• No OAuth credentials are committed to Git.
• Forgot Password link no longer leads to a missing page.

Notes

This issue is intended as a follow-up to the prototype authentication update.

The goal is not to completely refactor the authentication system. Keep the existing structure where possible and focus on fixing the identified security, configuration, and obvious functionality issues.