Security Best Practices

Security Best Practices in CodeIgniter (CodeIgniter 4)

Security is critical for any web application. CodeIgniter 4 provides many built-in security features, but they must be used correctly. Below are essential best practices you should always follow.

1. Input Validation & Sanitization

✅ Always validate user input
✅ Use CodeIgniter Validation library
❌ Never trust user input

$rules = [
    'email' => 'required|valid_email',
    'password' => 'required|min_length[6]'
];

$this->validate($rules);

2. Output Escaping (XSS Protection)

Always escape data in views:

<?= esc($user['name']) ?>

Use:

• esc() → HTML output

• esc($var, 'js') → JavaScript

• esc($var, 'url') → URLs

3. CSRF Protection

Enable CSRF globally:

app/Config/Filters.php

'csrf'

Add token to forms:

<?= csrf_field() ?>

4. SQL Injection Protection

✅ Use Query Builder or Models
❌ Avoid raw SQL

$model->where('email', $email)->first();

Query Builder auto-escapes values.

5. Password Security

Always hash passwords:

password_hash($password, PASSWORD_DEFAULT);

Verify:

password_verify($password, $hash);

❌ Never store plain-text passwords

6. Session Security

Use secure session settings:

public $sessionRegenerateDestroy = true;

Best practices:

• Regenerate session on login

• Use httponly cookies

• Destroy session on logout

7. Cookies Security

Set secure flags:

set_cookie([
    'name' => 'token',
    'value' => 'abc',
    'secure' => true,
    'httponly' => true,
    'samesite' => 'Strict'
]);

8. Disable Error Display in Production

In .env:

CI_ENVIRONMENT = production

Prevents exposing:

• Stack traces

• Database credentials

9. File Upload Security

Validate files strictly:

'file' => 'uploaded[file]|max_size[file,1024]|ext_in[file,jpg,png]'

Best practices:

• Rename uploaded files

• Store outside public/

• Restrict executable files

10. Use HTTPS

Force HTTPS:

$routes->setDefaultConstraint('https');

Or use filter:

forcehttps

11. Authentication & Authorization

✅ Protect routes with filters
✅ Use role-based access control

$routes->group('admin', ['filter' => 'auth'], function($routes) {});

12. API Security

• Use JWT or API keys

• Rate-limit requests

• Validate request headers

13. Security Headers

Enable headers like:

• X-Frame-Options

• X-Content-Type-Options

• Content-Security-Policy

Configured via:

app/Config/Security.php

14. Keep Framework Updated

✅ Update CodeIgniter regularly
✅ Monitor security advisories

15. Use Official Packages

For authentication:

• CodeIgniter Shield (Recommended)

Summary (Checklist)

✔ Validate all inputs
✔ Escape all outputs
✔ Enable CSRF
✔ Hash passwords
✔ Secure sessions & cookies
✔ Disable errors in production
✔ Use HTTPS