search

TeknooSoftware / sellsy-client

PHP library to connect your applications to your Sellsy account account using the Sellsy API and build your websites and your platforms on the Sellsy technology.
https://teknoo.software/libraries/sellsy
MIT License
17 stars 16 forks source link

OAuth nonce token collision #12

Closed Netsel closed 6 years ago

Netsel commented 6 years ago

We use this connector in our project shop order process to integrate various API from sellsy service.

To be state less in async worker, we use a new connector for each API call, and we had many returns with a http error code 401 in high traffic condition.

The problem would come from the nonce token used in : Teknoo\Sellsy\Client::setOAuthHeaders 'oauth_nonce' => \md5($now->getTimestamp() + \rand(0, 1000))

In fact, there a lot of chance to got the same hash within second with a rand(0, 1000).

The problem seem to be fixed simply by using a sha1 with microtime source : 'oauth_nonce' => \sha1(microtime(true) + mt_rand(0, 1000))

frenchcomp commented 6 years ago

Hi It's already fixed in last version relaesed yesterday ;) Richard

Netsel commented 6 years ago

Oh yeah, thanks ! :+1: