Cursor rule

1---
2description: Detect and prevent identification and authentication failures in Drupal as defined in OWASP Top 10:2021-A07
3globs: *.php, *.inc, *.module, *.install, *.info.yml, *.theme
4alwaysApply: false
5---
6# Drupal Identification and Authentication Failures Standards (OWASP A07:2021)
7 
8This rule enforces security best practices to prevent identification and authentication failures in Drupal applications, as defined in OWASP Top 10:2021-A07.
9 
10## Rule Details
11 
12- **Name:** drupal_authentication_failures
13 
14- **Description:** Detect and prevent identification and authentication failures in Drupal as defined in OWASP Top 10:2021-A07
15 
16## Filters
17- file extension pattern: `\\.(php|inc|module|install|theme|yml)$`
18- file path pattern: `.*`
19 
20## Enforcement Checks
21- Conditions:
22  - pattern `UserPasswordConstraint|PasswordPolicy|user\\.settings\\.yml` – Ensure strong password policies are configured to require complexity, length, and prevent common passwords.
23    - Pattern 1: Weak or missing password policies
24  - pattern `(authenticate|login|auth).*function[^}]*return\\s+(TRUE|true|1)\\s*;` – Custom authentication functions should implement proper validation and not return TRUE without checks.
25    - Pattern 2: Custom authentication without proper validation
26  - pattern `==\\s*\\$password|===\\s*\\$password|strcmp\\(|password_verify\\([^,]+,[^,]+\\$plainTextPassword` – Avoid direct password comparison. Use Drupal's built-in password verification services.
27    - Pattern 3: Improper password comparison
28  - pattern `(username|user|pass|password|pwd)\\s*=\\s*['\"][^'\"]+['\"]` – Hardcoded credentials detected. Store credentials securely outside of code.
29    - Pattern 4: Credentials in code
30  - pattern `drupal_get_token\\(|form_token|\\$form\\[['\"]#token['\"]\\]\\s*=|drupal_valid_token\\(` – Ensure proper CSRF protection is implemented for all authenticated actions.
31    - Pattern 5: Missing or weak CSRF protection
32  - pattern `setcookie\\(|session_regenerate_id\\(false\\)|session_regenerate_id\\([^\\)]*` – Use Drupal's session management. If custom code is required, ensure secure session handling practices.
33    - Pattern 6: Insecure session management
34  - pattern `user\\.flood\\.yml|flood_control|UserFloodControl|user_failed_login_` – Ensure proper account lockout and flood control mechanisms are configured to prevent brute force attacks.
35    - Pattern 7: Missing account lockout protection
36  - pattern `user_pass_reset|password_reset|reset.*token` – Verify password reset functionality uses secure tokens with proper expiration and validation.
37    - Pattern 8: Insecure password reset implementation
38  - pattern `tfa|two_factor|multi_factor|2fa` – Consider implementing multi-factor authentication for sensitive operations or user roles.
39    - Pattern 9: Lack of multi-factor authentication
40  - pattern `\\$user->name\\s*=\\s*['\"]admin['\"]|\\$name\\s*=\\s*['\"]admin['\"]|->values\\(['\"](mdc:name|mail)['\"]\\)\\s*->\\s*set\\(['\"][^\\'\"]+['\"]\\)` – Avoid creating default administrator accounts or test users in production code.
41    - Pattern 10: Default or test accounts
42 
43## Suggestions
44- Guidance:
45**Drupal Authentication Security Best Practices:**
46 
471. **Password Policies:**
48   - Use Drupal's Password Policy module for enforcing strong passwords
49   - Configure minimum password length (12+ characters recommended)
50   - Require complexity (uppercase, lowercase, numbers, special characters)
51   - Implement password rotation for sensitive roles
52   - Check passwords against known breached password databases
53 
542. **Authentication Infrastructure:**
55   - Use Drupal's core authentication mechanisms rather than custom solutions
56   - Implement proper account lockout after failed login attempts
57   - Consider multi-factor authentication (TFA module) for privileged accounts
58   - Implement session timeout for inactivity
59   - Use HTTPS for all authentication traffic
60 
613. **Session Management:**
62   - Use Drupal's session management system rather than PHP's session functions
63   - Configure secure session cookie settings in settings.php
64   - Implement proper session regeneration on privilege changes
65   - Consider using the Session Limit module to restrict concurrent sessions
66   - Properly destroy sessions on logout
67 
684. **Account Management:**
69   - Implement proper account provisioning and deprovisioning processes
70   - Use email verification for new account registration
71   - Implement secure password reset mechanisms with limited-time tokens
72   - Apply the principle of least privilege for user roles
73   - Regularly audit user accounts and permissions
74 
755. **Authentication Hardening:**
76   - Monitor for authentication failures and suspicious patterns
77   - Implement IP-based and username-based flood control
78   - Log authentication events for security monitoring
79   - Consider CAPTCHA or reCAPTCHA for login forms
80   - Use OAuth or SAML for single sign-on where appropriate
81 
82## Validation Checks
83- Conditions:
84  - pattern `password_verify\\(|UserPassword|\\\\Drupal::service\\(['\"]password['\"]\\)` – Using Drupal's password services correctly.
85    - Check 1: Proper password handling
86  - pattern `\\$form\\[['\"]#token['\"]\\]\\s*=\\s*['\"][^'\"]+['\"]` – Form includes CSRF protection token.
87    - Check 2: CSRF token implementation
88  - pattern `\\$request->getSession\\(\\)|\\\\Drupal::service\\(['\"]session['\"]\\)` – Using Drupal's session management services.
89    - Check 3: Proper session management
90  - pattern `user\\.flood\\.yml|flood|user_login_final_validate` – Implementing user flood protection.
91    - Check 4: User flood control
92 
93## Metadata
94- Priority: high
95- Version: 1.1
96- Tags: security, drupal, authentication, identification, owasp, language:php, framework:drupal, category:security, subcategory:authentication, standard:owasp-top10, risk:a07-authentication-failures
97## References
98- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/
99- https://www.drupal.org/docs/security-in-drupal/drupal-security-best-practices
100- https://www.drupal.org/project/tfa
101- https://www.drupal.org/project/password_policy
102 
103