search

djoos / EscapeWSSEAuthenticationBundle

Symfony bundle to implement WSSE authentication
http://symfony.com/doc/current/cookbook/security/custom_authentication_provider.html
137 stars 59 forks source link

Fix token expiration timezone bug #34

Closed olimsaidov closed 10 years ago

olimsaidov commented 10 years ago

There is bug in token expire validation when timezone is not GMT. This should fix it.

djoos commented 10 years ago

Hi guys,

would you be able to elaborate this a bit more?

AFAIK time() always returns a timestamp that is timezone independent (number of seconds since the Unix Epoch: January 1 1970 00:00:00 GMT) - which is what $created should be as well when generating the digest...

Thanks in advance for your feedback!

Kind regards, David

djoos commented 10 years ago

Hi guys,

any news on this issue?

Thanks in advance for your feedback! David

olimsaidov commented 10 years ago

It surely is. time() function is timezone independent. But strtotime() while converting uses default timezone set in php.ini or value explicitly set by date_default_timezone_set(). Hence there is a bug comparing two timestamps.

djoos commented 10 years ago

Thanks for the additional information @olimsaidov. Unfortunately I'm still not 100% sure there is an issue as...

int strtotime ( string $time [, int $now = time() ] )

The function expects to be given a string containing an English date format and will try to parse that format into a Unix timestamp (the number of seconds since January 1 1970 00:00:00 UTC)

As far as I'm aware it's then comparing epoch with epoch, which shouldn't be a problem... Thanks in advance for your feedback!

Kind regards, David

djoos commented 10 years ago

Thanks for your contribution @olimsaidov (and especially for your patience and the additional info! :-) )