BeSimple / BeSimpleSsoAuthBundle

NOT MAINTAINED - SSO authentication providers (Cas for now) for Symfony2
125 stars 76 forks source link

fix sslv3 parameters #87

Closed FloSeas closed 7 years ago

TMurgueUJM commented 8 years ago

Reading php documentation about SSL_version, you'd better do nothing at all, just let libcurl decides. Please, remove <parameter key="be_simple.sso_auth.client.option.curlopt_sslversion.key">32</parameter> and <parameter key="be_simple.sso_auth.client.option.curlopt_sslversion.value">3</parameter>

Php doc quote : "Your best bet is to not set this and let it use the default. Setting it to 2 or 3 is very dangerous given the known vulnerabilities in SSLv2 and SSLv3."