1. Platform architecture
ClassControl consists of a PHP web application and JSON API backed by MySQL, with native iOS and Android clients. Requests are scoped to an authenticated user and company.
↓ HTTPS
ClassControl API and web application
↓ authorised queries
MySQL database
2. Company segregation
Operational queries use company identifiers to restrict records to the authenticated organisation. Role checks further restrict administrative and instructor actions.
3. Authentication
Passwords are verified using secure password hashes. Mobile API requests present authentication tokens over HTTPS. Super Administrator accounts support authenticator-app MFA and single-use backup codes.
4. Trusted devices
A remembered device uses a random selector and validator. Only the selector and a SHA-256 hash of the validator are stored server-side. The browser cookie is Secure, HttpOnly and SameSite=Strict and expires after 30 days.
5. PAR-Q protection
Protected PAR-Q fields use AES-256-GCM with a new random nonce for each value. GCM authentication detects unauthorised alteration. Keys are loaded from a private configuration outside the public web directory.
6. QR attendance
The API verifies the scanner is an administrator or authorised instructor, the class belongs to the same company, the QR token belongs to a member in that company and the member has an active booking before attendance is marked.
7. Logging and monitoring
Application and hosting logs support diagnosis and incident investigation. Secrets, passwords, authentication codes and decrypted health information should not be intentionally written to logs.
8. Security roadmap
Planned hardening areas may include broader API-token hashing and expiry, central security middleware, expanded audit logging, automated dependency review, formal recovery testing and customer-facing service-status reporting.