thephpleague / oauth2-server

A spec compliant, secure by default PHP OAuth 2.0 Server
https://oauth2.thephpleague.com
MIT License
6.49k stars 1.12k forks source link

Possibility of using different encryptor for shortening auth code #1380

Closed damirius closed 8 months ago

damirius commented 8 months ago

Is there a possibility of using or configuring different encryptor and/or some settings so we can have shorter length of auth code? Currently auth code is 800-900 characters long for us, which I understand depends on the payload, but is there any option to shorten it through different salt generation and other config things in the encryptor?

Thanks!

Sephster commented 8 months ago

I think you can use ed25519 keys although I've not tested this myself of late. Pretty sure we did add support for this though.

 private function isValidKey($contents, $passPhrase)
    {
        $pkey = \openssl_pkey_get_private($contents, $passPhrase) ?: \openssl_pkey_get_public($contents);
        if ($pkey === false) {
            return false;
        }
        $details = \openssl_pkey_get_details($pkey);

        return $details !== false && \in_array(
            $details['type'] ?? -1,
            [OPENSSL_KEYTYPE_RSA, OPENSSL_KEYTYPE_EC],
            true
        );
    }

This function allows EC curves so I think the CryptKey class should allow it. They should be much shorter than RSA. Could you give it a try and let me know how you get on? Cheers

Sephster commented 8 months ago

Closing due to lack of activity. If you do try this, let me know how you get on. Cheers