PHP Authentication Mechanism Audit (Auth Audit)

Analyze PHP Web project source code, identify authentication and authorization links, determine the authentication status of each route, and detect risks of authentication bypass/permission escalation/IDOR.

CRITICAL: Complete Analysis (Mandatory)

Must process all routes appearing in
```
php-route-mapper
```
Must identify authentication chains: Session/JWT/middleware/custom validation functions
Must output route-authentication mapping table (no omissions)
For all suspicious points, provide: location evidence + data flow chain + exploitability analysis + verification PoC + repair suggestions

Runtime Modes (Mandatory: Align with Pipeline Stages)

This skill supports two modes to solve the problem of "cannot reference EVID_* before trace is generated":

```
STATIC_MAPPING
```
(Recommended for Pipeline Stage 1)
- Only generate
```
auth_mapping_{timestamp}.md
```
  (and optional
```
auth_README_{timestamp}.md
```
  )
- Allows missing references to
```
EVID_*
```
  evidence points from
```
php-route-tracer
```
- Must provide: authentication status classification (✅/⚠️/❌/❓) and P0/P1 bucket criteria (no PoC required)
```
TRACE_AUDIT
```
(Recommended for Pipeline Stage 4, trace exists)
- Generate complete
```
auth_audit_report_{timestamp}.md
```
  , and forcefully reference
```
EVID_*
```
  evidence points from the trace contract one by one
- PoC/repair suggestions must be complete

Vulnerability Severity Rating

See:

shared/SEVERITY_RATING.md

Input Dependencies

Recommended Input (consistent with

shared/IO_PATH_CONVENTION.md

; read equivalent sections in the total report when merging pipelines):

routes_{timestamp}.md

(when stored independently, usually

route_mapping/routes_{timestamp}.md

)

params_{timestamp}.md

(when stored independently, usually

route_mapping/params_{timestamp}.md

)

Optional:

```
source_path
```

Authentication Implementation Identification (Mandatory)

Identify by framework:

Laravel:

```
middleware('auth'|'can'|'role:')
```
```
Auth::check()/Auth::user()
```
Policies/Gates:
```
Gate::allows
```
,
```
->can({value})
```

Route protection:

Route::middleware([{value}])->group({value})

Symfony:
- security.yaml / access_control
- ```
denyAccessUnlessGranted
```
  ,
```
isGranted
```
- voter/policy

Native PHP:

```
session_start
```
+
```
$_SESSION
```
judgment

if (!isset($_SESSION['user']))

requireLogin()

Custom functions:
```
checkAuth/authorize/hasRole/isAdmin
```

Route-Authentication Mapping (Mandatory)

Output the following status for each route:

✅ Public: Explicitly allowed, no authentication checks
✅ Protected: Complete authentication/authorization checks exist
⚠️ Authentication-only: Only verifies login status, no role/resource-level authorization
❌ No authentication: No authentication links are hit
❓ Uncertain: Difficult to judge due to dynamic permissions/complex custom logic (evidence points must still be provided)

And output risk type:

AUTH

, including:

Authentication bypass (login status verification is bypassed)
Authorization bypass/permission escalation (role verification is missing or incorrect)
IDOR (object access lacks ownership/attribution verification)

Suspicious Pattern Detection (Mandatory, Provide Evidence Chain)

1) Authentication Bypass Caused by Path/URI Matching

Common root causes in PHP:

Use raw
```
$_SERVER['REQUEST_URI']
```
or
```
parse_url
```
results for whitelist matching, but the path is not normalized
Matching failure caused by encoding/case/duplicate slashes/trailing character differences (actual route enters protected handler)

Must output:

Whitelist check location and code snippet
Bypass request (PoC) and evidence of the hit handler

2) Only Verify Login Status, Missing Role/Resource Authorization

Must output:

Location of the route's "authentication check"
Location of "missing authorization check" (e.g., directly execute sensitive operations after only judging
```
user!=null
```
)

3) IDOR/Permission Escalation

Must output:

Where the sensitive object id comes from (GET/POST/URL)
Whether "ownership verification" for query/update exists (whether user_id/owner_id is included in the WHERE clause)
Reason for missing verification and accessibility

Report Output (By Runtime Mode)

Output to:

{output_path}/auth_audit/
├── auth_audit_report_{timestamp}.md
├── auth_mapping_{timestamp}.md
└── auth_README_{timestamp}.md

Mandatory Rules:

```
STATIC_MAPPING
```
: Must generate
```
auth_mapping_{timestamp}.md
```
;
```
auth_audit_report_{timestamp}.md
```
can be omitted or generated as an empty shell (marked as: bucket mapping only, no trace evidence)
```
TRACE_AUDIT
```
: Must generate all three files, and require complete trace evidence points

File 1: Main Report

auth_audit_report_{timestamp}.md

Includes:

Authentication Framework Identification (including version/implementation evidence)
Authentication Architecture Overview (middleware/functions/handlers)
Risk statistics
Complete vulnerability structure for each risk (ID/severity/data flow/PoC/repair)

File 2: Mapping Table

auth_mapping_{timestamp}.md

Only list routes, authentication status, required roles/conditions (do not include detailed vulnerability analysis). But must add bucket fields (for route selection in Pipeline Stage 3):

```
p_bucket
```
:
```
P0
```
or
```
P1
```
- ```
P0
```
  : ❌ No authentication
- ```
P1
```
  : ⚠️ Authentication-only, or detected authorization bypass/permission escalation/IDOR risks (even if authentication status shows "authentication-only", explain why it enters P1 in
```
p1_reason
```
  )
```
p1_reason
```
: A brief static basis (e.g., "Only login status, missing hasRole/authorize or missing owner_id verification")

File 3: Documentation

auth_README_{timestamp}.md

Only explain methodology, tools and verification guidelines, do not include specific vulnerability details.

Mandatory PoC Verification Template

Must distinguish at least the following scenarios:

Unauthenticated access (no cookie/session/JWT)
Regular user access (regular account cookie/JWT)
Admin/high-privilege control (if applicable)

PoC must be an executable HTTP request code block, and the route path must use real route rules.

Evidence Reference (Mandatory by Runtime Mode)

```
STATIC_MAPPING
```
: No mandatory requirement to reference
```
EVID_*
```
evidence points from trace (only need to output authentication classification and P0/P1 bucket criteria).
```
TRACE_AUDIT
```
: Each suspected authentication risk must reference evidence from trace output item by item (status can be marked as pending verification, but evidence references must exist):

```
EVID_AUTH_PATH_PROTECTED_MATCH
```
: Evidence of path matching for routes entering protected handlers (corresponding to branch path evidence in trace)
```
EVID_AUTH_TOKEN_DECODE_JUDGMENT
```
: Evidence of how login status/Token decoding results are judged (corresponding to session/JWT reading and conditional branches in trace)
```
EVID_AUTH_PERMISSION_CHECK_EXEC
```
: Evidence of execution of permission judgment functions or conditional statements (such as
```
hasRole/authorize
```
) (trace sink location or branch evidence)
```
EVID_AUTH_IDOR_OWNERSHIP_CONDITION
```
: Evidence of whether IDOR ownership verification (WHERE/condition) includes owner_id/user_id (final query condition or status update statement in trace)

Tracer Evidence Missing Handling (Mandatory)

```
STATIC_MAPPING
```
: Not applicable (bucket criteria are based on static code evidence).
```
TRACE_AUDIT
```
: If trace contract verification fails or any of the key evidence points 1~4 cannot be located: the risk can only be marked as
```
⚠️Pending Verification
```
, and conclusions like
```
✅Confirmed Exploitable
```
or "definitely bypassable" must not be given.

php-auth-audit

NPX Install

Tags

SKILL.md Content (Chinese)

PHP Authentication Mechanism Audit (Auth Audit)

CRITICAL: Complete Analysis (Mandatory)

Runtime Modes (Mandatory: Align with Pipeline Stages)

Vulnerability Severity Rating

Input Dependencies

Authentication Implementation Identification (Mandatory)

Route-Authentication Mapping (Mandatory)

Suspicious Pattern Detection (Mandatory, Provide Evidence Chain)

1) Authentication Bypass Caused by Path/URI Matching

2) Only Verify Login Status, Missing Role/Resource Authorization

3) IDOR/Permission Escalation

Report Output (By Runtime Mode)

File 1: Main Report
`auth_audit_report_{timestamp}.md`

File 2: Mapping Table
`auth_mapping_{timestamp}.md`

File 3: Documentation
`auth_README_{timestamp}.md`

Mandatory PoC Verification Template

Evidence Reference (Mandatory by Runtime Mode)

Tracer Evidence Missing Handling (Mandatory)