Security & Authentication
Relevant source files
The following files were used as context for generating this wiki page:
Security and authentication components protect the PrestaShop application by managing user access, encrypting credentials, and mitigating common web vulnerabilities. The system integrates Symfony's security component for the Back Office while maintaining legacy utilities for cross-component security tasks like password generation and input sanitization.
This system ensures that only authorized administrators access the Back Office and provides tools to prevent Cross-Site Request Forgery (CSRF) and Server-Side Request Forgery (SSRF).
Admin Authentication Framework
PrestaShop utilizes the Symfony Authenticator Manager to handle Back Office logins. The configuration defines firewalls, providers, and access control rules to secure administrative routes.
Security Configuration
The application configures an admin user provider and a main firewall that manages form-based logins. It uses an automated password hasher with a work factor (cost) of 15 for enhanced brute-force resistance.
| Component | Description | Source |
|---|---|---|
password_hashers | Uses 'auto' algorithm for authenticated users with cost 15. | app/config/admin/security.yml:7-12 |
firewalls.main | Handles admin_login, logout, and remember_me functionality. | app/config/admin/security.yml:25-39 |
access_control | Defines public routes and requires IS_AUTHENTICATED for others. | app/config/admin/security.yml:42-49 |
Authentication Success Handling
Upon successful login, the AdminAuthenticationSuccessHandler determines the redirection target. It prioritizes the _target_path from the session if the user attempted to access a specific protected page before authenticating.
The diagram shows the logic used to redirect administrators after a successful login session.
Sources: src/PrestaShopBundle/Security/Admin/AdminAuthenticationSuccessHandler.php:39-50
Password Management
The PasswordGenerator class provides a utility for creating secure, random strings for user credentials. It supports multiple complexity levels via flags.
Generation Modes
| Flag | Description | Source |
|---|---|---|
PASSWORDGEN_FLAG_NUMERIC | Generates a string containing only digits. | src/Core/Security/PasswordGenerator.php:33 |
PASSWORDGEN_FLAG_ALPHANUMERIC | Generates a string with letters and digits. | src/Core/Security/PasswordGenerator.php:36 |
PASSWORDGEN_FLAG_RANDOM | Generates a string with letters, digits, and symbols. | src/Core/Security/PasswordGenerator.php:35 |
PASSWORDGEN_FLAG_NO_NUMERIC | Generates a string containing only letters. | src/Core/Security/PasswordGenerator.php:34 |
Implementation Detail
The generator relies on the OpenSSL wrapper to obtain cryptographically secure pseudo-random bytes.
Sources: src/Core/Security/PasswordGenerator.php:57-89, classes/Tools.php:143-151
Network & Request Security
PrestaShop implements strict validation for external requests to prevent Server-Side Request Forgery (SSRF) and IP spoofing.
SSRF Mitigation
The Tools class contains logic to validate untrusted URLs, particularly during imports. It maintains an allow-list of schemes (http, https, ftp, ftps) and blocks private or reserved IP ranges to prevent access to internal infrastructure.
This flow illustrates the multi-step validation process for fetching content from external sources.
Sources: classes/Tools.php:48-100, classes/Tools.php:1008-1065
CSRF Protection
Tokens are generated using a hash of the customer ID, password, and the current script name. This prevents unauthorized command execution from malicious third-party sites.
Sources: classes/Tools.php:690-705
Sanitization and Output Security
To prevent Cross-Site Scripting (XSS), the system provides several layers of output escaping and HTML purification.
- HTML Purifier: The
purifyHTMLmethod uses theHTMLPurifierlibrary to strip malicious scripts while allowing safe tags like<video>or<iframe>if configured. - Static Escaping:
Tools::safeOutputandTools::htmlentitiesUTF8provide standard encoding for displaying user-supplied strings in templates. - SQL Parsing:
Tools::parserSQLutilizesPHPSQLParserto inspect and validate raw SQL strings before execution.
Sources: classes/Tools.php:522-545, classes/Tools.php:1270-1340, classes/Tools.php:1152-1159
Vulnerability Reporting
PrestaShop maintains a private disclosure policy for security issues. Discoverers are encouraged to use the official Bug Bounty Program rather than publishing details publicly.
Sources: .github/SECURITY.md:14-25
PrestaShop combines modern Symfony security practices for identity management with robust utility classes for low-level request and data protection. This layered approach addresses both application-level authentication and infrastructure-level network security.