php-auth-audit

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

PHP 鉴权机制审计（Auth Audit）

PHP Authentication Mechanism Audit (Auth Audit)

分析 PHP Web 项目源码，识别认证与授权链路，判断每条路由的鉴权状态，并检测鉴权绕过/越权/IDOR 风险。

Analyze PHP Web project source code, identify authentication and authorization links, determine the authentication status of each route, and detect risks of authentication bypass/permission escalation/IDOR.

CRITICAL：完整分析（强制）

CRITICAL: Complete Analysis (Mandatory)

必须处理所有在
```
php-route-mapper
```
中出现的路由
必须识别认证链：Session/JWT/中间件/自定义校验函数
必须输出路由-鉴权映射表（不做省略）
对所有可疑点给出：位置证据 + 数据流链 + 可利用性分析 + 验证 PoC + 修复建议

Must process all routes appearing in
```
php-route-mapper
```
Must identify authentication chains: Session/JWT/middleware/custom validation functions
Must output route-authentication mapping table (no omissions)
For all suspicious points, provide: location evidence + data flow chain + exploitability analysis + verification PoC + repair suggestions

运行模式（强制：与流水线阶段对齐）

Runtime Modes (Mandatory: Align with Pipeline Stages)

此技能支持两种模式，用于解决“尚未生成 trace 之前无法引用 EVID_*”的问题：

```
STATIC_MAPPING
```
（推荐用于流水线阶段 1）
- 只生成
```
auth_mapping_{timestamp}.md
```
  （以及可选的
```
auth_README_{timestamp}.md
```
  ）
- 允许缺少
```
php-route-tracer
```
  的
```
EVID_*
```
  证据点引用
- 必须给出：鉴权状态分级（✅/⚠️/❌/❓）与 P0/P1 分桶依据（不需要 PoC）
```
TRACE_AUDIT
```
（推荐用于流水线阶段 4，trace 已存在）
- 生成完整的
```
auth_audit_report_{timestamp}.md
```
  ，并强制逐条引用 trace 契约中的
```
EVID_*
```
  证据点
- PoC/修复建议必须齐全

This skill supports two modes to solve the problem of "cannot reference EVID_* before trace is generated":

```
STATIC_MAPPING
```
(Recommended for Pipeline Stage 1)
- Only generate
```
auth_mapping_{timestamp}.md
```
  (and optional
```
auth_README_{timestamp}.md
```
  )
- Allows missing references to
```
EVID_*
```
  evidence points from
```
php-route-tracer
```
- Must provide: authentication status classification (✅/⚠️/❌/❓) and P0/P1 bucket criteria (no PoC required)
```
TRACE_AUDIT
```
(Recommended for Pipeline Stage 4, trace exists)
- Generate complete
```
auth_audit_report_{timestamp}.md
```
  , and forcefully reference
```
EVID_*
```
  evidence points from the trace contract one by one
- PoC/repair suggestions must be complete

漏洞分级

Vulnerability Severity Rating

详见：

shared/SEVERITY_RATING.md

See:

shared/SEVERITY_RATING.md

输入依赖

Input Dependencies

建议输入（与

shared/IO_PATH_CONVENTION.md

一致；合并流水线时读总报告中等价章节）：

routes_{timestamp}.md

（独立落盘时常为

route_mapping/routes_{timestamp}.md

）

params_{timestamp}.md

（独立落盘时常为

route_mapping/params_{timestamp}.md

）

可选：

```
source_path
```

Recommended Input (consistent with

shared/IO_PATH_CONVENTION.md

; read equivalent sections in the total report when merging pipelines):

routes_{timestamp}.md

(when stored independently, usually

route_mapping/routes_{timestamp}.md

)

params_{timestamp}.md

(when stored independently, usually

route_mapping/params_{timestamp}.md

)

Optional:

```
source_path
```

识别鉴权实现（必做）

Authentication Implementation Identification (Mandatory)

按框架识别：

Laravel：

```
middleware('auth'|'can'|'role:')
```
```
Auth::check()/Auth::user()
```
Policies/Gates：
```
Gate::allows
```
、
```
->can({value})
```

路由保护：

Route::middleware([{value}])->group({value})

Symfony：
- security.yaml / access_control
- ```
denyAccessUnlessGranted
```
  、
```
isGranted
```
- voter/policy

原生 PHP：

```
session_start
```
+
```
$_SESSION
```
判断

if (!isset($_SESSION['user']))

requireLogin()

自定义函数：
```
checkAuth/authorize/hasRole/isAdmin
```

Identify by framework:

Laravel:

```
middleware('auth'|'can'|'role:')
```
```
Auth::check()/Auth::user()
```
Policies/Gates:
```
Gate::allows
```
,
```
->can({value})
```

Route protection:

Route::middleware([{value}])->group({value})

Symfony:
- security.yaml / access_control
- ```
denyAccessUnlessGranted
```
  ,
```
isGranted
```
- voter/policy

Native PHP:

```
session_start
```
+
```
$_SESSION
```
judgment

if (!isset($_SESSION['user']))

requireLogin()

Custom functions:
```
checkAuth/authorize/hasRole/isAdmin
```

路由-鉴权映射（必做）

Route-Authentication Mapping (Mandatory)

对每条路由输出以下状态：

✅ 公开：显式允许，无鉴权检查
✅ 受保护：存在完整认证/授权检查
⚠️ 仅认证：只校验登录态，无角色/资源级授权
❌ 无鉴权：没有任何鉴权链路命中
❓ 不确定：动态权限/复杂自定义逻辑导致难判（仍必须写出证据点）

并输出风险类型：

AUTH

，包括：

认证绕过（登录态校验被绕过）
授权绕过/越权（角色校验缺失或错误）
IDOR（对象访问缺少所有权/归属校验）

Output the following status for each route:

✅ Public: Explicitly allowed, no authentication checks
✅ Protected: Complete authentication/authorization checks exist
⚠️ Authentication-only: Only verifies login status, no role/resource-level authorization
❌ No authentication: No authentication links are hit
❓ Uncertain: Difficult to judge due to dynamic permissions/complex custom logic (evidence points must still be provided)

And output risk type:

AUTH

, including:

Authentication bypass (login status verification is bypassed)
Authorization bypass/permission escalation (role verification is missing or incorrect)
IDOR (object access lacks ownership/attribution verification)

可疑模式检测（必做，给出证据链）

Suspicious Pattern Detection (Mandatory, Provide Evidence Chain)

1) 路径/URI 匹配导致鉴权绕过

1) Authentication Bypass Caused by Path/URI Matching

在 PHP 中常见根因：

用原始
```
$_SERVER['REQUEST_URI']
```
或
```
parse_url
```
结果做白名单匹配，但路径未规范化
编码/大小写/重复斜杠/尾部字符差异导致匹配失败（实际路由进入受保护 handler）

必须输出：

白名单检查位置与代码片段
绕过请求（PoC）与命中的 handler 证据

Common root causes in PHP:

Use raw
```
$_SERVER['REQUEST_URI']
```
or
```
parse_url
```
results for whitelist matching, but the path is not normalized
Matching failure caused by encoding/case/duplicate slashes/trailing character differences (actual route enters protected handler)

Must output:

Whitelist check location and code snippet
Bypass request (PoC) and evidence of the hit handler

2) 仅校验登录态，缺少角色/资源授权

2) Only Verify Login Status, Missing Role/Resource Authorization

必须输出：

路由的“认证检查”位置
“授权检查缺失”位置（例如只判断
```
user!=null
```
后直接执行敏感操作）

Must output:

Location of the route's "authentication check"
Location of "missing authorization check" (e.g., directly execute sensitive operations after only judging
```
user!=null
```
)

3) IDOR/越权

3) IDOR/Permission Escalation

必须输出：

敏感对象 id 来自哪里（GET/POST/URL）
用于查询/更新的“归属校验”是否存在（WHERE 里是否包含 user_id/owner_id）
未校验的原因与可达性

Must output:

Where the sensitive object id comes from (GET/POST/URL)
Whether "ownership verification" for query/update exists (whether user_id/owner_id is included in the WHERE clause)
Reason for missing verification and accessibility

报告输出（按运行模式）

Report Output (By Runtime Mode)

输出到：

{output_path}/auth_audit/
├── auth_audit_report_{timestamp}.md
├── auth_mapping_{timestamp}.md
└── auth_README_{timestamp}.md

强制规则：

```
STATIC_MAPPING
```
：必须生成
```
auth_mapping_{timestamp}.md
```
；
```
auth_audit_report_{timestamp}.md
```
可以省略或生成空壳（并标注：仅分桶映射，不含 trace 证据）
```
TRACE_AUDIT
```
：必须生成完整三文件，并要求 trace 证据点齐全

Output to:

{output_path}/auth_audit/
├── auth_audit_report_{timestamp}.md
├── auth_mapping_{timestamp}.md
└── auth_README_{timestamp}.md

Mandatory Rules:

```
STATIC_MAPPING
```
: Must generate
```
auth_mapping_{timestamp}.md
```
;
```
auth_audit_report_{timestamp}.md
```
can be omitted or generated as an empty shell (marked as: bucket mapping only, no trace evidence)
```
TRACE_AUDIT
```
: Must generate all three files, and require complete trace evidence points

文件1：主报告

auth_audit_report_{timestamp}.md

File 1: Main Report

auth_audit_report_{timestamp}.md

包含：

鉴权框架识别（含版本/实现证据）
鉴权架构概览（middleware/函数/handler）
风险统计
每条风险的完整漏洞结构（编号/分级/数据流/PoC/修复）

Includes:

Authentication Framework Identification (including version/implementation evidence)
Authentication Architecture Overview (middleware/functions/handlers)
Risk statistics
Complete vulnerability structure for each risk (ID/severity/data flow/PoC/repair)

文件2：映射表

auth_mapping_{timestamp}.md

File 2: Mapping Table

auth_mapping_{timestamp}.md

只列路由与鉴权状态、所需角色/条件（不要放漏洞详细分析）。但必须新增分桶字段（用于流水线阶段 3 选路）：

```
p_bucket
```
：
```
P0
```
或
```
P1
```
- ```
P0
```
  ：❌ 无鉴权
- ```
P1
```
  ：⚠️ 仅认证，或检测到存在授权绕过/越权/IDOR 风险（即使鉴权状态显示为“仅认证”，也要在
```
p1_reason
```
  里说明为什么进入 P1）
```
p1_reason
```
：一段简短静态依据（如“仅登录态，缺少 hasRole/authorize 或缺少 owner_id 校验”）

Only list routes, authentication status, required roles/conditions (do not include detailed vulnerability analysis). But must add bucket fields (for route selection in Pipeline Stage 3):

```
p_bucket
```
:
```
P0
```
or
```
P1
```
- ```
P0
```
  : ❌ No authentication
- ```
P1
```
  : ⚠️ Authentication-only, or detected authorization bypass/permission escalation/IDOR risks (even if authentication status shows "authentication-only", explain why it enters P1 in
```
p1_reason
```
  )
```
p1_reason
```
: A brief static basis (e.g., "Only login status, missing hasRole/authorize or missing owner_id verification")

文件3：说明文档

auth_README_{timestamp}.md

File 3: Documentation

auth_README_{timestamp}.md

只说明方法论、工具与验证指南，不包含具体漏洞细节。

Only explain methodology, tools and verification guidelines, do not include specific vulnerability details.

PoC 验证模板（强制）

Mandatory PoC Verification Template

必须区分至少以下场景：

未登录访问（无 cookie/session/JWT）
普通用户访问（普通账号 cookie/JWT）
管理员/高权限对照（如适用）

PoC 必须是可执行 HTTP 请求代码块，并且路由路径必须使用真实路由规则。

Must distinguish at least the following scenarios:

Unauthenticated access (no cookie/session/JWT)
Regular user access (regular account cookie/JWT)
Admin/high-privilege control (if applicable)

PoC must be an executable HTTP request code block, and the route path must use real route rules.

证据引用（按运行模式强制）

Evidence Reference (Mandatory by Runtime Mode)

```
STATIC_MAPPING
```
：不强制引用 trace 的
```
EVID_*
```
证据点（只需输出鉴权分级与 P0/P1 分桶依据）。
```
TRACE_AUDIT
```
：每条疑似鉴权风险必须逐项引用 trace 输出中的证据（允许状态标记为待验证，但证据引用必须存在）：

```
EVID_AUTH_PATH_PROTECTED_MATCH
```
：路由进入受保护 handler 的路径匹配证据（对应 trace 的分支路径证据）
```
EVID_AUTH_TOKEN_DECODE_JUDGMENT
```
：登录态/Token 解码结果如何被判断的证据（对应 trace 中 session/JWT 读取与条件分支）
```
EVID_AUTH_PERMISSION_CHECK_EXEC
```
：权限判断函数或条件语句（如
```
hasRole/authorize
```
）的执行证据（trace sink 定位或分支证据）
```
EVID_AUTH_IDOR_OWNERSHIP_CONDITION
```
：IDOR 归属校验（WHERE/条件）是否包含 owner_id/user_id 的证据（trace 中最终查询条件或状态更新语句）

```
STATIC_MAPPING
```
: No mandatory requirement to reference
```
EVID_*
```
evidence points from trace (only need to output authentication classification and P0/P1 bucket criteria).
```
TRACE_AUDIT
```
: Each suspected authentication risk must reference evidence from trace output item by item (status can be marked as pending verification, but evidence references must exist):

```
EVID_AUTH_PATH_PROTECTED_MATCH
```
: Evidence of path matching for routes entering protected handlers (corresponding to branch path evidence in trace)
```
EVID_AUTH_TOKEN_DECODE_JUDGMENT
```
: Evidence of how login status/Token decoding results are judged (corresponding to session/JWT reading and conditional branches in trace)
```
EVID_AUTH_PERMISSION_CHECK_EXEC
```
: Evidence of execution of permission judgment functions or conditional statements (such as
```
hasRole/authorize
```
) (trace sink location or branch evidence)
```
EVID_AUTH_IDOR_OWNERSHIP_CONDITION
```
: Evidence of whether IDOR ownership verification (WHERE/condition) includes owner_id/user_id (final query condition or status update statement in trace)

tracer 证据缺失处理（强制）

Tracer Evidence Missing Handling (Mandatory)

```
STATIC_MAPPING
```
：不适用（分桶依据以静态代码证据为准）。
```
TRACE_AUDIT
```
：若 trace 契约校验失败或无法定位 1~4 任一关键证据点：该风险只能标记为
```
⚠️待验证
```
，不得给出
```
✅已确认可利用
```
或“确定可绕过”的结论。

```
STATIC_MAPPING
```
: Not applicable (bucket criteria are based on static code evidence).
```
TRACE_AUDIT
```
: If trace contract verification fails or any of the key evidence points 1~4 cannot be located: the risk can only be marked as
```
⚠️Pending Verification
```
, and conclusions like
```
✅Confirmed Exploitable
```
or "definitely bypassable" must not be given.

php-auth-audit

Original

Translation

PHP 鉴权机制审计（Auth Audit）

PHP Authentication Mechanism Audit (Auth Audit)

CRITICAL：完整分析（强制）

CRITICAL: Complete Analysis (Mandatory)

运行模式（强制：与流水线阶段对齐）

Runtime Modes (Mandatory: Align with Pipeline Stages)

漏洞分级

Vulnerability Severity Rating

输入依赖

Input Dependencies

识别鉴权实现（必做）

Authentication Implementation Identification (Mandatory)

路由-鉴权映射（必做）

Route-Authentication Mapping (Mandatory)

可疑模式检测（必做，给出证据链）

Suspicious Pattern Detection (Mandatory, Provide Evidence Chain)

1) 路径/URI 匹配导致鉴权绕过

1) Authentication Bypass Caused by Path/URI Matching

2) 仅校验登录态，缺少角色/资源授权

2) Only Verify Login Status, Missing Role/Resource Authorization

3) IDOR/越权

3) IDOR/Permission Escalation

报告输出（按运行模式）

Report Output (By Runtime Mode)

文件1：主报告
`auth_audit_report_{timestamp}.md`

File 1: Main Report
`auth_audit_report_{timestamp}.md`

文件2：映射表
`auth_mapping_{timestamp}.md`

File 2: Mapping Table
`auth_mapping_{timestamp}.md`

文件3：说明文档
`auth_README_{timestamp}.md`

File 3: Documentation
`auth_README_{timestamp}.md`

PoC 验证模板（强制）

Mandatory PoC Verification Template

证据引用（按运行模式强制）

Evidence Reference (Mandatory by Runtime Mode)

tracer 证据缺失处理（强制）

Tracer Evidence Missing Handling (Mandatory)