Use random_bytes to generate tokens

Author: stof

Resources/config/util.xml

@@ -12,9 +12,7 @@
             <argument type="service" id="fos_user.user_manager" />
         </service>
 
-        <service id="fos_user.util.token_generator.default" class="FOS\UserBundle\Util\TokenGenerator" public="false">
-            <argument type="service" id="logger" on-invalid="ignore" />
-        </service>
+        <service id="fos_user.util.token_generator.default" class="FOS\UserBundle\Util\TokenGenerator" public="false" />
 
     </services>
 

Util/TokenGenerator.php

@@ -11,52 +11,13 @@
 
 namespace FOS\UserBundle\Util;
 
-use Symfony\Component\HttpKernel\Log\LoggerInterface;
-
 class TokenGenerator implements TokenGeneratorInterface
 {
-    private $logger;
-    private $useOpenSsl;
-
-    public function __construct(LoggerInterface $logger = null)
-    {
-        $this->logger = $logger;
-
-        // determine whether to use OpenSSL
-        if (defined('PHP_WINDOWS_VERSION_BUILD') && version_compare(PHP_VERSION, '5.3.4', '<')) {
-            $this->useOpenSsl = false;
-        } elseif (!function_exists('openssl_random_pseudo_bytes')) {
-            if (null !== $this->logger) {
-                $this->logger->notice('It is recommended that you enable the "openssl" extension for random number generation.');
-            }
-            $this->useOpenSsl = false;
-        } else {
-            $this->useOpenSsl = true;
-        }
-    }
-
+    /**
+     * {@inheritdoc}
+     */
     public function generateToken()
     {
-        return rtrim(strtr(base64_encode($this->getRandomNumber()), '+/', '-_'), '=');
-    }
-
-    private function getRandomNumber()
-    {
-        $nbBytes = 32;
-
-        // try OpenSSL
-        if ($this->useOpenSsl) {
-            $bytes = openssl_random_pseudo_bytes($nbBytes, $strong);
-
-            if (false !== $bytes && true === $strong) {
-                return $bytes;
-            }
-
-            if (null !== $this->logger) {
-                $this->logger->info('OpenSSL did not produce a secure random number.');
-            }
-        }
-
-        return hash('sha256', uniqid(mt_rand(), true), true);
+        return rtrim(strtr(base64_encode(random_bytes(32)), '+/', '-_'), '=');
     }
 }

composer.json

@@ -21,6 +21,7 @@
     ],
     "require": {
         "php": ">=5.3.2",
+        "paragonie/random_compat": "^1 || ^2",
         "symfony/framework-bundle": "~2.3",
         "symfony/security-bundle": "~2.3"
     },