note 104953 deleted from oauthprovider.generatetoken by danbrown

Note Submitter: Lyuben Penkovski (l_penkovski at yahoo dot com) ---- Just a quick warning about the second parameter of the function - $strong = false Do not use $strong = true when creating your tokens with this method. We had an awful experience and it took us a day to debug and find the reason for this. It happened accidentally and it was not exposed as a problem for months. Our server was using the $strong = true way of generating tokens and everything was fine. Then one day, there was some change in the machine - Linux version, PHP version or Virtual hosts options - I don't know exactly, because the system administrators did the job, however from that moment, our server was responding with 10,20,30,40 seconds delays... It was random, it was happening from time to time, and it was very annoying... After one day of debugging their changes and configuration and after we didn't find anything suspicious it was by reading the code of our server line by line to see that this was the problem... Once we changed it to FALSE, everything was good to go again... There is one quesion at http://security.stackexchange.com with an answer that is explaining very well, why you should never use that option in general, not only in this library: "Or, to say it in less words: use /dev/urandom and be happy; use /dev/random and be sorry." http://security.stackexchange.com/questions/3936/is-a-rand-from-dev-urandom-secure-for-a-login-key/3939#3939