drupal-authentication-failures

Drupal Identification and Authentication Failures Standards (OWASP A07:2021)

This rule enforces security best practices to prevent identification and authentication failures in Drupal applications, as defined in OWASP Top 10:2021-A07.

actions:

• type: enforce conditions:

  Pattern 1: Weak or missing password policies

  • pattern: "UserPasswordConstraint|PasswordPolicy|user\.settings\.yml" message: "Ensure strong password policies are configured to require complexity, length, and prevent common passwords."

  Pattern 2: Custom authentication without proper validation

  • pattern: "(authenticate|login|auth).*function[^}]return\s+(TRUE|true|1)\s;" message: "Custom authentication functions should implement proper validation and not return TRUE without checks."

  Pattern 3: Improper password comparison

  • pattern: "==\s*\$password|===\s*\$password|strcmp\(|password_verify\([^,]+,[^,]+\$plainTextPassword" message: "Avoid direct password comparison. Use Drupal's built-in password verification services."

  Pattern 4: Credentials in code

  • pattern: "(username|user|pass|password|pwd)\s*=\s*['"][^'"]+['"]" message: "Hardcoded credentials detected. Store credentials securely outside of code."

  Pattern 5: Missing or weak CSRF protection

  • pattern: "drupal_get_token\(|form_token|\$form\[['"]#token['"]\]\s*=|drupal_valid_token\(" message: "Ensure proper CSRF protection is implemented for all authenticated actions."

  Pattern 6: Insecure session management

  • pattern: "setcookie\(|session_regenerate_id\(false\)|session_regenerate_id\([^\)]*" message: "Use Drupal's session management. If custom code is required, ensure secure session handling practices."

  Pattern 7: Missing account lockout protection

  • pattern: "user\.flood\.yml|flood_control|UserFloodControl|user_failed_login_" message: "Ensure proper account lockout and flood control mechanisms are configured to prevent brute force attacks."

  Pattern 8: Insecure password reset implementation

  • pattern: "user_pass_reset|password_reset|reset.*token" message: "Verify password reset functionality uses secure tokens with proper expiration and validation."

  Pattern 9: Lack of multi-factor authentication

  • pattern: "tfa|two_factor|multi_factor|2fa" message: "Consider implementing multi-factor authentication for sensitive operations or user roles."

  Pattern 10: Default or test accounts

  • pattern: "\$user->name\s*=\s*['"]admin['"]|\$name\s*=\s*['"]admin['"]|->values\('"['"]\)\s*->\s*set\(['"][^\'"]+['"]\)" message: "Avoid creating default administrator accounts or test users in production code."

• type: suggest message: | Drupal Authentication Security Best Practices:

  1. Password Policies:

     • Use Drupal's Password Policy module for enforcing strong passwords
     • Configure minimum password length (12+ characters recommended)
     • Require complexity (uppercase, lowercase, numbers, special characters)
     • Implement password rotation for sensitive roles
     • Check passwords against known breached password databases

  2. Authentication Infrastructure:

     • Use Drupal's core authentication mechanisms rather than custom solutions
     • Implement proper account lockout after failed login attempts
     • Consider multi-factor authentication (TFA module) for privileged accounts
     • Implement session timeout for inactivity
     • Use HTTPS for all authentication traffic