note 104953 added to oauthprovider.generatetoken

Just a quick warning about the second parameter of the function - $strong = false Do not use $strong = true when creating your tokens with this method. We had an awful experience and it took us a day to debug and find the reason for this. It happened accidentally and it was not exposed as a problem for months. Our server was using the $strong = true way of generating tokens and everything was fine. Then one day, there was some change in the machine - Linux version, PHP version or Virtual hosts options - I don't know exactly, because the system administrators did the job, however from that moment, our server was responding with 10,20,30,40 seconds delays... It was random, it was happening from time to time, and it was very annoying... After one day of debugging their changes and configuration and after we didn't find anything suspicious it was by reading the code of our server line by line to see that this was the problem... Once we changed it to FALSE, everything was good to go again... There is one quesion at http://security.stackexchange.com with an answer that is explaining very well, why you should never use that option in general, not only in this library: "Or, to say it in less words: use /dev/urandom and be happy; use /dev/random and be sorry." http://security.stackexchange.com/questions/3936/is-a-rand-from-dev-urandom-secure-for-a-login-key/3939#3939 ---- Server IP: 69.147.83.197 Probable Submitter: 213.226.63.174 ---- Manual Page -- http://www.php.net/manual/en/oauthprovider.generatetoken.php Edit -- https://master.php.net/note/edit/104953 Del: integrated -- https://master.php.net/note/delete/104953/integrated Del: useless -- https://master.php.net/note/delete/104953/useless Del: bad code -- https://master.php.net/note/delete/104953/bad+code Del: spam -- https://master.php.net/note/delete/104953/spam Del: non-english -- https://master.php.net/note/delete/104953/non-english Del: in docs -- https://master.php.net/note/delete/104953/in+docs Del: other reasons-- https://master.php.net/note/delete/104953 Reject -- https://master.php.net/note/reject/104953 Search -- https://master.php.net/manage/user-notes.php