@@ -1228,62 +1228,6 @@ cookie will be ever created by Symfony):
1228
1228
If you use a form login, Symfony will create a cookie even if you set
1229
1229
``stateless `` to ``true ``.
1230
1230
1231
- Utilities
1232
- ---------
1233
-
1234
- .. versionadded :: 2.2
1235
- The ``StringUtils `` and ``SecureRandom `` classes were introduced in Symfony
1236
- 2.2
1237
-
1238
- The Symfony Security component comes with a collection of nice utilities related
1239
- to security. These utilities are used by Symfony, but you should also use
1240
- them if you want to solve the problem they address.
1241
-
1242
- Comparing Strings
1243
- ~~~~~~~~~~~~~~~~~
1244
-
1245
- The time it takes to compare two strings depends on their differences. This
1246
- can be used by an attacker when the two strings represent a password for
1247
- instance; it is known as a `Timing attack `_.
1248
-
1249
- Internally, when comparing two passwords, Symfony uses a constant-time
1250
- algorithm; you can use the same strategy in your own code thanks to the
1251
- :class: `Symfony\\ Component\\ Security\\ Core\\ Util\\ StringUtils ` class::
1252
-
1253
- use Symfony\Component\Security\Core\Util\StringUtils;
1254
-
1255
- // is password1 equals to password2?
1256
- $bool = StringUtils::equals($password1, $password2);
1257
-
1258
- Generating a secure random Number
1259
- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1260
-
1261
- Whenever you need to generate a secure random number, you are highly
1262
- encouraged to use the Symfony
1263
- :class: `Symfony\\ Component\\ Security\\ Core\\ Util\\ SecureRandom ` class::
1264
-
1265
- use Symfony\Component\Security\Core\Util\SecureRandom;
1266
-
1267
- $generator = new SecureRandom();
1268
- $random = $generator->nextBytes(10);
1269
-
1270
- The
1271
- :method: `Symfony\\ Component\\ Security\\ Core\\ Util\\ SecureRandom::nextBytes `
1272
- methods returns a random string composed of the number of characters passed as
1273
- an argument (10 in the above example).
1274
-
1275
- The SecureRandom class works better when OpenSSL is installed but when it's
1276
- not available, it falls back to an internal algorithm, which needs a seed file
1277
- to work correctly. Just pass a file name to enable it::
1278
-
1279
- $generator = new SecureRandom('/some/path/to/store/the/seed.txt');
1280
- $random = $generator->nextBytes(10);
1281
-
1282
- .. note ::
1283
-
1284
- You can also access a secure random instance directly from the Symfony
1285
- dependency injection container; its name is ``security.secure_random ``.
1286
-
1287
1231
.. _book-security-checking-vulnerabilities :
1288
1232
1289
1233
Checking for Known Security Vulnerabilities in Dependencies
0 commit comments