Re: Make sessions use php_random_bytes in 7.1
| From: | Tom Worster | Date: | Sun, 01 Nov 2015 20:02:47 +0000 |
| Subject: | Re: Make sessions use php_random_bytes in 7.1 | ||
| References: | 1 2 3 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-89028@lists.php.net to get a copy of this message | ||
On 11/1/15, 12:40 PM, "Leigh" <leight@gmail.com> wrote:
>On 1 November 2015 at 16:07, Tom Worster <fsb@thefsb.org> wrote:
>
>
>I don't have one.
>
>But if I may ask, I'm curious, as always: What happens in the case that
>php_random_bytes() fails?
>
>Tom
>
>
>That's a good point.
>
>session_start() would throw the exception generated by php_random_bytes()
>letting you know your system is incapable of generating high quality
>random numbers.
I think that's entirely satisfactory.
>However this is a serious issue in it's own right, the APIs used (and the
>way they are used) really only fail if the underlying environment is
>fubar.
Agreed.
Tom