search

slimphp / Slim

Slim is a PHP micro framework that helps you quickly write simple yet powerful web applications and APIs.
http://slimframework.com
MIT License
11.94k stars 1.95k forks source link

Slim\Http\Util uses unauthenticated encryption #1035

Closed sarciszewski closed 9 years ago

sarciszewski commented 9 years ago

https://github.com/slimphp/Slim/blob/2c434e4186aae6b1f7b490e03eabc1c086e8d553/Slim/Http/Util.php#L92-L126 https://github.com/slimphp/Slim/blob/2c434e4186aae6b1f7b490e03eabc1c086e8d553/Slim/Http/Util.php#L142-L177

I suggest wrapping a much better solution instead:

https://github.com/defuse/php-encryption

From the authors of PHP: The Right Way I have to say I'm not impressed. Also, MCRYPT_RIJNDAEL_256 isn't AES-256.

sarciszewski commented 9 years ago

See also #1037