Authentication in Magento

Admin Login Flow

Magento uses session-based authentication for admin users with multi-factor authentication support.

// app/code/Vendor/Module/Model/Auth.php
namespace Vendor\Module\Model;

use Magento\Backend\Model\Auth;
use Magento\User\Model\UserFactory;

class CustomAuth extends Auth
{
    private $userFactory;

    public function __construct(
        UserFactory $userFactory
    ) {
        $this->userFactory = $userFactory;
    }

    public function login($username, $password)
    {
        $user = $this->userFactory->create()->load($username, 'username');
        
        if (!$user->getId()) {
            throw new \Exception('Invalid username');
        }

        if ($this->verifyPassword($password, $user->getPassword())) {
            $this->setUser($user);
            $this->processLogin();
            return true;
        }

        return false;
    }
}

Authentication Configuration

<!-- app/code/Vendor/Module/etc/adminhtml/system.xml -->
<config>
    <section id="admin">
        <group id="security">
            <field id="session_lifetime" translate="label" type="text">
                <label>Admin Session Lifetime (seconds)</label>
            </field>
            <field id="max_password_lifetime" translate="label" type="text">
                <label>Maximum Password Lifetime</label>
            </field>
        </group>
    </section>
</config>

Key Points

• Admin sessions expire based on configured lifetime
• Failed login attempts are logged and can trigger lockout
• Password policies enforce complexity requirements
• Session data is stored in the database by default

REST API Tokens

Magento supports token-based authentication for REST API access.

# Get admin token
curl -X POST "https://magento.example.com/rest/V1/integration/admin/token" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "admin",
    "password": "admin123"
  }'

# Response: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

Using API Tokens

# Use token in requests
curl -X GET "https://magento.example.com/rest/V1/products" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

Integration Tokens

// Create integration with API access
use Magento\Integration\Model\IntegrationFactory;

class IntegrationTokenManager
{
    private $integrationFactory;

    public function createIntegration($name, $apiResources)
    {
        $integration = $this->integrationFactory->create();
        $integration->setName($name);
        $integration->setConsumerId($this->createConsumer($apiResources));
        $integration->setStatus(1);
        $integration->save();

        return $integration;
    }
}

Key Points

• Admin tokens expire after 4 hours by default
• Consumer tokens have restricted resource access
• Tokens should be stored securely, never in version control
• Use environment variables for token storage

Session Configuration

// app/etc/env.php
return [
    'session' => [
        'save' => 'db',           // 'db', 'redis', or 'memcached'
        'save_path' => '/var/session',
        'session_cache_limiter' => 'private_no_cache',
    ],
];

Redis Session Storage

// app/etc/env.php
return [
    'session' => [
        'save' => 'redis',
        'redis' => [
            'host' => '127.0.0.1',
            'port' => '6379',
            'password' => '',
            'timeout' => '2.5',
            'persistent_identifier' => '',
            'database' => '0',
            'compression_threshold' => '2048',
        ],
    ],
];

Session Security

// Security headers for session protection
use Magento\Framework\Controller\Result\RedirectFactory;

class SecureSession
{
    public function setSecurityHeaders()
    {
        header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
        header('X-Content-Type-Options: nosniff');
        header('X-Frame-Options: DENY');
        header('X-XSS-Protection: 1; mode=block');
    }
}

Key Points

• Redis/Memcached recommended for high-traffic stores
• Session lifetime configurable per store view
• Session hijacking prevented with secure cookies
• Regenerate session ID after login

Magento Password Hashing

Magento uses bcrypt with configurable work factors.

use Magento\Framework\Encryption\EncryptorInterface;

class PasswordManager
{
    private $encryptor;

    public function __construct(EncryptorInterface $encryptor)
    {
        $this->encryptor = $encryptor;
    }

    public function hashPassword($password)
    {
        // Uses bcrypt with work factor 12
        return $this->encryptor->getHash($password);
    }

    public function verifyPassword($password, $hash)
    {
        return $this->encryptor->validateHash($password, $hash);
    }
}

Password Policy Configuration

<!-- app/code/Vendor/Module/etc/adminhtml/system.xml -->
<field id="password_policy" translate="label" type="text">
    <label>Password Policy</label>
    <comment><![CDATA[
        Minimum 8 characters, at least one uppercase, one lowercase,
        one number, one special character
    ]]></comment>
</field>

Custom Hash Algorithm

// Override default hashing (not recommended)
namespace Vendor\Module\Model\Encryption;

use Magento\Framework\Encryption\CryptInterface;

class CustomCrypt implements CryptInterface
{
    public function hash($data)
    {
        return password_hash($data, PASSWORD_ARGON2ID);
    }
}

Key Points

• Bcrypt work factor increases with hardware improvements
• Passwords are never stored in plain text
• Hash rehashing happens automatically on login if needed
• Password reset tokens expire after 24 hours