Security

Node Authorization allows users to add simple HTTP authorization to individual nodes. This is not a replacement for the user and content access system, just a lightweight alternative to create simple access restrictions on per-node basis. Note that HTTP authorization is not a totally secure system, particularly on non-HTTPS sites. If you require robust security to protect sensitive node content, please use Drupal's more established content access system.

The module is designed to obviate the need to propagate the block of an IP address that is "offensive" across the managed websites portfolio. Whether the websites are hosted at a web agency, or by a third party supplier, or the customer itself among an internal infrastructure.

The aim is to provide a first, but essential, level of protection for those occasions when there is no access to the server.

This module provides an Encryption Method plugin to be used with the Drupal 8 Encrypt module. Accordingly, the plugin uses AES-256-CBC cipher via the OpenSSL PHP extension along with HMAC-SHA256 for authentication of the encrypted data.

For enhanced security, the encrypt()/decrypt() functions are taken directly from this excellent resource Encryption, Authentication & Data Integrity in PHP by Enrico Zimuel.

Encryption

This module provides a simple two way encryption solution. There are no module dependencies. It uses openssl which is compiled into php (unless explicitly omitted) to encrypt/decrypt using AES-256-CTR.

You can use dependency injection or Drupal::service('encryption') to get the encryption service. The following is a simple example on how the service can be used:

This is the D8+ version of the Encrypted Files project.

Introduction

The file encrypt module allows you to encrypt files uploaded via Drupal using the Encrypt and Key modules. When encrypted files are requested, they will be decrypted automatically.

The CSRF Protection module provides form_token for drupal forms to Anonymous users.

This module provides advanced email address checking. Detecting mistyped email addresses in javascript. Domain blacklist.

If pages on your site contain links to untrusted sites and those links open in a new window, your users may be vulnerable to phishing attacks. A full explanation of this vulnerability is available here and here. The long and short of it is that links opened in a new window are granted some access to the originating window.

This is a provider plugin module for the HybridAuth Social Login authentication platform.

This module provides a HybridAuth "provider" to support InBay Technologies' idQ® Trust as a Service (TaaS) passwordless authentication solution.