search

OWASP / phpsec

OWASP PHP Security Project - THIS PROJECT IS INACTIVE AND MAY CONTAIN SECURITY FLAWS
197 stars 103 forks source link

Correct csrf and random #107

Closed asgrim closed 8 years ago

asgrim commented 8 years ago

random_bytes and random_int should be used for randomness.

In order of preference:

  1. Use libsodium if available.
  2. fread() /dev/urandom if available (never on Windows)
  3. mcrypt_create_iv($bytes, MCRYPT_CREATE_IV)
  4. COM('CAPICOM.Utilities.1')->GetRandom()
  5. openssl_random_pseudo_bytes() (absolute last resort)