Yii2: Add TLS as Best Practice to the Guide

[tom--]

Yii 2 provides features that rely on cookies and/or PHP sessions. These can be vulnerable. The vulnerability is reduced if the app runs on TLS.

Hence I suggest the mos def guide's page on Best Practices should have another heading to explain that if the app uses these features of Yii, it should run the app over TLS.

This section could usefully also point to an external resource for finding up-to-date information on configuring TLS, perhaps h5bp.

[samdark]

Good idea. What's h5bp?

[tom--]

https://html5boilerplate.com/ has recommended server configs that try to keep up to date with BCPs for ciphers and protocols. e.g. https://github.com/h5bp/server-configs-nginx/blob/49aac219455eea948b983d5c656bbacc431413ee/h5bp/directive-only/ssl.conf#L6

[devypt]

@samdark @tom-- can i make a pull request for this?

[cebe]

@devypt sure, go ahead :)