magdev/wc-licensed-product-client
1
Fork 0
Code Issues Pull Requests Activity

Update session history with security layer learnings

Browse Source 
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Marco Grätsch
2026-01-22 16:20:27 +01:00
parent 8aec2b21a9
commit 8616292543
1 changed files with 23 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
CLAUDE.md
View File

@@ -129,3 +129,26 @@ When editing CLAUDE.md or other markdown files, follow these rules to avoid lint
- `LicenseClient` designed for obfuscation: all sensitive logic contained in single class
- Symfony HttpClient works well with PSR interfaces via `symfony/http-client-contracts`
- Keep a Changelog format allows duplicate headings per version (MD024 warning can be ignored)
### 2026-01-22 - Version 0.0.2 (Security Layer)
**Completed:**
- Added PHPUnit ^11.0 test framework with 66 tests total
- Implemented `SecureLicenseClient` with response signature verification
- Created `ResponseSignature` class for HMAC-SHA256 signing/verification
- Created `StringEncoder` for XOR-based string obfuscation
- Created `IntegrityChecker` for source file hash verification
- Added `SignatureException` and `IntegrityException` for security errors
- Documented server-side implementation in `docs/server-implementation.md`
- Merged all changes to main branch
**Learnings:**
- Response signature verification (HMAC) is more secure than code obfuscation alone
- Per-license key derivation prevents cross-license signature reuse
- Timestamp validation (5-minute tolerance) prevents replay attacks
- Server must sign responses with matching algorithm for client verification
- IntegrityChecker normalizes line endings for cross-platform hash consistency
- StringEncoder uses XOR with expanded key for simple obfuscation (not encryption)
- PHPUnit 11 uses PHP 8 attributes (`#[Test]`, `#[CoversClass]`) instead of annotations