403
Access Denied
The server could not process your request.
Please verify your input and try again.
REF: {$refId}
Secure Connection
HTML;
exit;
}
/**
* Quick protect - One line protection
*
* @param string $apiKey Your API key
* @return bool True if allowed, false if blocked
*/
public static function quick(string $apiKey): bool
{
static $instance = null;
if ($instance === null) {
$instance = new self($apiKey);
}
return $instance->protect();
}
/**
* Check if request is an attack (returns details)
*
* @return array Detailed security result
*/
public function check(): array
{
$startTime = microtime(true);
$requestId = $this->generateRequestId();
try {
$requestData = $this->buildRequestData($requestId);
$result = $this->callApi($requestData, $requestId);
$result['processing_time_ms'] = round((microtime(true) - $startTime) * 1000, 2);
$result['request_id'] = $requestId;
$result['kriosa_version'] = self::VERSION;
return $result;
} catch (Exception $e) {
return [
'allowed' => true,
'error' => $e->getMessage(),
'processing_time_ms' => round((microtime(true) - $startTime) * 1000, 2),
'request_id' => $requestId,
'kriosa_version' => self::VERSION,
'fallback' => true
];
}
}
/**
* Build complete request data automatically
*/
private function buildRequestData(string $requestId): array
{
// Get server data
$server = $_SERVER;
// Get client IP (handles proxies)
$ip = $this->getClientIp();
// Get user agent
$userAgent = $server['HTTP_USER_AGENT'] ?? '';
// Get request method
$method = $server['REQUEST_METHOD'] ?? 'GET';
// Get request URI
$uri = $server['REQUEST_URI'] ?? '/';
// Get session ID if available
$sessionId = session_id() ?: null;
// Get user ID from session if available
$userId = $_SESSION['user_id'] ?? $_SESSION['userid'] ?? $_SESSION['uid'] ?? 0;
$username = $_SESSION['username'] ?? $_SESSION['user'] ?? $_SESSION['email'] ?? null;
// Get tenant ID from session if available
$tenantId = $_SESSION['tenant_id'] ?? $_SESSION['tenant'] ?? null;
// Get company ID from session if available
$companyId = $_SESSION['company_id'] ?? $_SESSION['company'] ?? null;
// Check if authenticated
$isAuthenticated = ($userId > 0) || !empty($server['HTTP_AUTHORIZATION']) || !empty($server['HTTP_X_API_KEY']);
return [
// API key (the source of truth on your server)
'api_key' => $this->apiKey,
// Request metadata
'request_id' => $requestId,
'timestamp' => time(),
'source' => 'kriosa_php_sdk_v3',
// Client information
'ip_address' => $ip,
'user_agent' => $userAgent,
'session_id' => $sessionId,
// Session user info (if available)
'session_user_id' => $userId,
'session_username' => $username,
'session_tenant_id' => $tenantId,
'session_company_id' => $companyId,
// Request details
'method' => $method,
'resource' => $uri,
'path' => $uri,
'query_string' => $server['QUERY_STRING'] ?? '',
'payload' => $this->getPayload(),
'query_params' => $_GET,
'headers' => $this->getRelevantHeaders(),
// Authentication status
'is_authenticated' => $isAuthenticated,
// SDK metadata
'sdk_version' => self::VERSION,
'sdk_language' => 'php',
'php_version' => PHP_VERSION
];
}
/**
* Get request payload (handles JSON, form data, etc.)
*/
private function getPayload(): array
{
// Check for JSON input
$contentType = $_SERVER['CONTENT_TYPE'] ?? '';
if (strpos($contentType, 'application/json') !== false) {
$input = file_get_contents('php://input');
if ($input) {
$data = json_decode($input, true);
if (is_array($data)) {
return $data;
}
}
}
// Return POST data
return $_POST;
}
/**
* Get relevant headers for security analysis
*/
private function getRelevantHeaders(): array
{
$headers = [];
$relevant = [
'HTTP_REFERER' => 'Referer',
'HTTP_ORIGIN' => 'Origin',
'HTTP_ACCEPT_LANGUAGE' => 'Accept-Language',
'HTTP_ACCEPT_ENCODING' => 'Accept-Encoding',
'HTTP_X_FORWARDED_FOR' => 'X-Forwarded-For',
'HTTP_X_REAL_IP' => 'X-Real-IP',
'HTTP_X_REQUEST_ID' => 'X-Request-Id'
];
foreach ($relevant as $serverKey => $headerName) {
if (isset($_SERVER[$serverKey]) && $_SERVER[$serverKey]) {
$headers[$headerName] = $_SERVER[$serverKey];
}
}
return $headers;
}
/**
* Get real client IP (handles Cloudflare, proxies, load balancers)
*/
private function getClientIp(): string
{
$ip = null;
// Cloudflare
if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
$ip = $_SERVER['HTTP_CF_CONNECTING_IP'];
}
// Nginx proxy
elseif (isset($_SERVER['HTTP_X_REAL_IP'])) {
$ip = $_SERVER['HTTP_X_REAL_IP'];
}
// Load balancer / proxy
elseif (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
$ips = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
$ip = trim($ips[0]);
}
// Direct connection
elseif (isset($_SERVER['REMOTE_ADDR']) && !empty($_SERVER['REMOTE_ADDR'])) {
$ip = $_SERVER['REMOTE_ADDR'];
}
// Localhost fallback
else {
$ip = '127.0.0.1';
}
// ========== FIX: Convert IPv6 localhost to IPv4 ==========
if ($ip === '::1' || $ip === '0:0:0:0:0:0:0:1') {
$ip = '127.0.0.1';
}
// Handle cases where IP is empty or invalid
if (empty($ip) || $ip === '0.0.0.0') {
$ip = '127.0.0.1';
}
// =========================================================
// DEBUG: Log the IP being sent
error_log("KRIOSA SDK: Final IP = " . $ip);
return $ip;
}
/**
* Validate IP address
*/
private function isValidIp(string $ip): bool
{
return filter_var($ip, FILTER_VALIDATE_IP) !== false;
}
/**
* Call the Kriosa API
*/
private function callApi(array $requestData, string $requestId): array
{
if (!function_exists('curl_init')) {
$this->log("cURL not available", ['request_id' => $requestId]);
return $this->fallbackResponse('cURL not available');
}
$ch = curl_init($this->apiUrl);
$jsonData = json_encode($requestData);
if ($jsonData === false) {
return $this->fallbackResponse('JSON encoding failed');
}
$headers = [
'Content-Type: application/json',
'Accept: application/json',
'User-Agent: Kriosa-PHP-SDK/' . self::VERSION,
'X-Request-ID: ' . $requestId
];
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => $jsonData,
CURLOPT_HTTPHEADER => $headers,
CURLOPT_TIMEOUT => $this->timeout,
CURLOPT_CONNECTTIMEOUT => 3,
CURLOPT_SSL_VERIFYPEER => true,
CURLOPT_SSL_VERIFYHOST => 2,
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_MAXREDIRS => 2
]);
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$curlError = curl_error($ch);
curl_close($ch);
$this->log("API response", [
'request_id' => $requestId,
'http_code' => $httpCode,
'response_length' => strlen($response)
]);
if ($response === false) {
$this->log("cURL error", ['request_id' => $requestId, 'error' => $curlError]);
return $this->fallbackResponse($curlError);
}
if ($httpCode === 403) {
return ['allowed' => false, 'reason' => 'attack_blocked'];
}
if ($httpCode !== 200) {
$this->log("Unexpected status code", ['request_id' => $requestId, 'http_code' => $httpCode]);
return $this->fallbackResponse("HTTP {$httpCode}");
}
$result = json_decode($response, true);
if (!is_array($result)) {
return $this->fallbackResponse('Invalid JSON response');
}
return $result;
}
/**
* Fallback response when API is unreachable
*/
private function fallbackResponse(string $reason = ''): array
{
$this->log("Using fallback mode", ['reason' => $reason]);
// Basic local pattern check as last resort
if ($this->hasLocalAttackPattern()) {
return ['allowed' => false, 'reason' => 'local_pattern_match'];
}
return ['allowed' => true, 'fallback' => true, 'reason' => $reason];
}
/**
* Basic local attack pattern check (fallback only)
*/
private function hasLocalAttackPattern(): bool
{
$input = json_encode($_POST) . ' ' . json_encode($_GET) . ' ' . ($_SERVER['REQUEST_URI'] ?? '');
$patterns = [
'/\b(union\s+select|select.*from|insert\s+into|delete\s+from|drop\s+table)\b/i',
'/