Why 2FA?
Nowadays we have noticed that many of the websites or applications that we access offer the option to activate an extra layer of security called Two Factor Authentication, better known as 2FA. Most of our lives happen on our mobile devices and laptops, so it’s not a secret that cyber-thieves would like to gain access to our personal and financial data. This is why adding an extra layer for protecting logins is worth it. 2FA is an extra layer of security to make sure that someone that is trying to gain access to an account is who they say they are. The first layer is generally a combination of a username and password, and the second layer could ask for a code that is sent to your phone, a fingerprint scan or the name of your best friend. Currently 2FA has become a security standard in the digital world.How does it work?
First the user will enter his username and password, then instead of getting in immediately into the system, he will be required to provide additional information. Which could be one of the following options or factors:- Something you know : This could be a password, a personal identification number (PIN), answers to a secret question or a specific keystroke pattern.
- Something you have: This is something the user owns, a physical device, like a mobile phone, an id card, an usb stick, a token, etc.
- Something you are: This could be face or voice recognition, retina scan, fingerprint, DNA, handwriting.
CakeDC Users Plugin and 2FA
There are various ways to implement Time-based One-Time Password (TOTP), Short Message Service (SMS), Electronic Mail (Email), Universal Second Factor (U2F). CakeDC Users Plugin provides the ability to enable in your site TOTP or U2F.TOTP Google Authenticator
Enabling 2FA Google Authenticator in CakeDC Users Plugin is quite easy, it just takes a few minutes. In case you have not installed CakeDC Users Plugin in your application, follow the installation steps described here. Once you have installed the plugin and your basic login is working, you just need to do the following:-
Run the next command:
composer require robthree/twofactorauth -
In Application::pluginBootstrap() add the following:
Configure::write('OneTimePasswordAuthenticator.login', true);
-
Type your username and password.
-
You proceed to the next step where you are asked for the authentication code
-
First time you will be shown a QR code that you need to scan from your authenticator application.
-
Next time you will only get the input to type your authentication code
-
First time you will be shown a QR code that you need to scan from your authenticator application.
- You open the authenticator application to get a secondary code called a one-time password (OTP)—usually six characters in length. There are many options in the market for the authenticator application, some of the most used are: Google Authenticator, Duo Mobile, FreeOTP etc.
- You type the 6-digit code into the website, and you’re in!
FIDO U2F
If you want something more solid and reliable, then you could use U2F (Universal 2nd Factor) standard created by the FIDO Alliance. With this kind of authentication you use a physical security key, and insert that into your PC, touch the key’s button, and you’re “automatically” logged in. U2F standard was implemented in CakeDC Users Plugin by using the YubiKey, the most famous and common example of U2F. To enable 2FA via Yubico follow the next steps:-
Run the next command:
composer require yubico/u2flib-server:^1.0 -
In Application::pluginBootstrap() add the following:
Configure::write(‘U2f.enabled’, true);
So, what to choose for two-factor authentication? There is no universal answer, it will depend on the level of security you are expecting, but start protecting your account by enabling 2FA! In this article you could noticed how easy is to enable 2FA in any CakePHP application by using CakeDC Users Plugin.
References: https://github.com/CakeDC/users https://en.wikipedia.org/wiki/Multi-factor_authentication https://en.wikipedia.org/wiki/One-time_password https://en.wikipedia.org/wiki/FIDO_Alliance https://en.wikipedia.org/wiki/Universal_2nd_Factor
3. Tests? Baked tests are enough, aren’t they?
Ehm.. no. You won’t be a bad developer if you don’t have 100% coverage. Even more, I don’t like to talk about what coverage is good because it exclusively depends on the project itself. I would say that you should feel good if your core features are fully covered.
4. Why should I put the code in one place only if you can copy and paste it everywhere?
Even most modern IDEs identify this as a bad practice now, but this is something we see in almost every code we get for review. People prefer to copy and paste the same function in multiple classes instead of creating a Component or Behavior or even a library and use it everywhere.
5. Plugins? What is a plugin?
CakePHP has a very large set of available plugins, or you can always start your own plugin and publish it so other people can use it. Plugins are one of the most important features in CakePHP since you can encapsulate a feature or a set of features to use them in multiple projects. Just be careful and don’t overplugin.
6. How the hell would somebody hash a password?
Well, even when you think it's a joke, no, it's not. Some people think hashing a password is not required. CakePHP provides several options for password hashing to secure your application.
7. Do you document your code? I don’t think it is useful.
Having the availability of documentation aids in understanding the intended use, as well as the expected functionality and result of the code's execution. It is pretty easy if you just document your code while you are doing it instead of waiting to have 20 classes to document.
8. Should I declare variables to execute find methods / DB / Service requests or should I put them inside a for/while loop to "save" memory?
Please no, doing external service requests (DB / File / Web Service) from inside a loop affects application performance very badly. You should always try to put the result in a variable and then use it inside the loop.
9. Who needs coding standards?
Coding standards help make code more readable and maintainable. For CakePHP applications, the Cake Conventions and Coding Standards should be applied.
10. Is it better to make all calculations inside for/while loops level in code instead of calculating at the DB/query level?
Data iteration at the DB level offers way better performance than iteration done at the application level.
![](https://i.imgur.com/ky39PFY.jpg src="//s.imgur.com/min/embed.js" charset="utf-8"></script> )
Basically, what I am trying to say is to choose a development team, and choose wisely. The team should start with asking your needs and wants, and your vision for the project. An experienced development team can bring that project to life. The decision you make now, can save time, money, and many meltdowns in the future. Don’t say I didn’t warn you (just kidding…kinda).
* Install the plugin using
Let’s talk about the event, and the workshops. Jorge Gonzalez, Jose Rodriquez, and Mark Story definitely delivered in the knowledge department. The participation was fantastic, although the class size was smaller than in other years. We’ve had a lot of requests for their slides, so those are included in the link below ⬇️ One thing that was different this year, is that we had different venues for the workshops and conference. This makes it difficult for the team, with transferring our equipment in such a busy city (shout out to the quick responding taxi services). We did try the metro when we had less baggage, and got up close and personal with the locals. Speaking of venues, we cannot thank 
If you are a PHPer or specifically working with CakePHP, the speakers topics were overflowing with useful information. Like Yuki Kanazawa’s tips for a smooth upgrade to CakePHP 3, or Tadahisa Motooka’s ideas about database replication. Kazuki Higashiguchi helped talk us through painful testing of code, and Sho Ito walked us through an initial OSS with CakePHP. We had such a great lineup this year, and we cannot wait to have some speakers return. Other great talks included David Yell, Daniel Voyce, Jose Gonzalez, and Wim Godden, and superstar core members Mark Story and Jose Rodriguez. We even had to be confronted with details about life after CakePHP (GASP!) from Andrej Griniuk.
Unfortunately, no event can be executed without some roadblocks, and we aren’t exempt. We had a couple late cancellations (understandable) from speakers, but definitely made up the time with chats and lightning talks. There was so much information exerted during the short 2 days, that we all probably needed and extra day to take notes. Luckily, we did that for you. All of the slides included during CakeFest are available at the link below as well.
So, would we come back and host in Japan again? YES! We hope to do so sooner rather than later. Are there some things we will change on our end? Yes, again. We hoped for higher numbers for workshops, as the information given is invaluable. We hope that in the future, all conference attendees will take advantage of those sessions as well. You can stay up to date with all things CakeFest at 
We could not have done all of this without the amazing sponsors we had this year:
Now we need to customize our new pool adding a pool name, etc. We can use default settings for testing purposes. If you want to customize fields you should then go through steps.
Once we check everything is okay we can click on Create Pool.
Now, it's time to setup App Clients. If you are familiar with OAuth and another services it is like creating a Facebook or Twitter App.
And then click on Add an app client. Just add a name and save.
Remember to write down your client ID and client secret because they will be needed later to configure Users plugin.
The next step is to setup app client settings. We need to configure:
Finally we need to configure a domain name for the user pool. Use a custom domain or a subdomain from Cognito.
Now that we are ready with Cognito setup, let’s easily create a new CakePHP app, to connect with Amazon Cognito.
First, we need a new CakePHP app:
composer create-project --prefer-dist cakephp/app users-app
Remember to create a new empty database.
Now we can go to users-app folder and run:
composer require cakedc/users
After CakeDC Users plugin is installed, we need to install Oauth 2 Cognito provider package:
composer require cakedc/oauth2-cognito
CakeDC Users plugin configuration is pretty easy:
$this->addPlugin('CakeDC/Users');
public function pluginBootstrap()
{
parent::pluginBootstrap();
Configure::load('users');
}
and click on Sign in with Cognito. If everything is setup correctly you should see the following screen:
You can previously create a user in AWS panel or just click signup on that screen. After login you will be redirected to homepage in CakePHP App.
As you can see, the setup for both Cognito and App are simple if you use default settings. However after testing defaults, you can start customizing forms, fields, adding third party apps. You have no limits.
