ZF1 Authentication and Sessions Modernization

Authentication bugs in ZF1 apps are rarely “framework mysteries”—they are outdated password storage, loose session cookies, and ACL rules embedded in controllers. Modernize the security properties even if the UI stays on ZF1 temporarily.

Password storage

// LEGACY — do not perpetuate
$hash = md5($password);
$hash = sha1($salt . $password);

// MODERN
$hash = password_hash($password, PASSWORD_DEFAULT);
if (password_verify($password, $hash)) { /* ok */ }
// rehash when needed with password_needs_rehash()

Session cookie flags

Set Secure, HttpOnly, and appropriate SameSite in php.ini or session ini settings used by the ZF1 bootstrap. Cross-check failures with SameSite cookie blocked and secure cookie over HTTP.

// LEGACY default-era mindset
// session cookie often lacked Secure/HttpOnly/SameSite discipline

// MODERN explicit ini (example values — tune per deploy)
ini_set('session.cookie_secure', '1');
ini_set('session.cookie_httponly', '1');
ini_set('session.cookie_samesite', 'Lax');

Zend_Auth / Zend_Acl maintenance tips

• Keep adapters thin; move credential checks behind a testable service.
• Centralize ACL maps—avoid copy-pasted if ($role === 'admin') in every action.
• Prefer server-side authorization always; never trust hidden form fields for roles.

Related: ZF1 forms, Xdebug notes for debugging login redirects.