Skip to content

Commit 81cae40

Browse files
committed
Fixing bad merge - this section should not have been left in
1 parent d9c2209 commit 81cae40

File tree

1 file changed

+0
-56
lines changed

1 file changed

+0
-56
lines changed

book/security.rst

Lines changed: 0 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -1228,62 +1228,6 @@ cookie will be ever created by Symfony):
12281228
If you use a form login, Symfony will create a cookie even if you set
12291229
``stateless`` to ``true``.
12301230

1231-
Utilities
1232-
---------
1233-
1234-
.. versionadded:: 2.2
1235-
The ``StringUtils`` and ``SecureRandom`` classes were introduced in Symfony
1236-
2.2
1237-
1238-
The Symfony Security component comes with a collection of nice utilities related
1239-
to security. These utilities are used by Symfony, but you should also use
1240-
them if you want to solve the problem they address.
1241-
1242-
Comparing Strings
1243-
~~~~~~~~~~~~~~~~~
1244-
1245-
The time it takes to compare two strings depends on their differences. This
1246-
can be used by an attacker when the two strings represent a password for
1247-
instance; it is known as a `Timing attack`_.
1248-
1249-
Internally, when comparing two passwords, Symfony uses a constant-time
1250-
algorithm; you can use the same strategy in your own code thanks to the
1251-
:class:`Symfony\\Component\\Security\\Core\\Util\\StringUtils` class::
1252-
1253-
use Symfony\Component\Security\Core\Util\StringUtils;
1254-
1255-
// is password1 equals to password2?
1256-
$bool = StringUtils::equals($password1, $password2);
1257-
1258-
Generating a secure random Number
1259-
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1260-
1261-
Whenever you need to generate a secure random number, you are highly
1262-
encouraged to use the Symfony
1263-
:class:`Symfony\\Component\\Security\\Core\\Util\\SecureRandom` class::
1264-
1265-
use Symfony\Component\Security\Core\Util\SecureRandom;
1266-
1267-
$generator = new SecureRandom();
1268-
$random = $generator->nextBytes(10);
1269-
1270-
The
1271-
:method:`Symfony\\Component\\Security\\Core\\Util\\SecureRandom::nextBytes`
1272-
methods returns a random string composed of the number of characters passed as
1273-
an argument (10 in the above example).
1274-
1275-
The SecureRandom class works better when OpenSSL is installed but when it's
1276-
not available, it falls back to an internal algorithm, which needs a seed file
1277-
to work correctly. Just pass a file name to enable it::
1278-
1279-
$generator = new SecureRandom('/some/path/to/store/the/seed.txt');
1280-
$random = $generator->nextBytes(10);
1281-
1282-
.. note::
1283-
1284-
You can also access a secure random instance directly from the Symfony
1285-
dependency injection container; its name is ``security.secure_random``.
1286-
12871231
.. _book-security-checking-vulnerabilities:
12881232

12891233
Checking for Known Security Vulnerabilities in Dependencies

0 commit comments

Comments
 (0)