diff --git a/components/security/secure_tools.rst b/components/security/secure_tools.rst index 4363f25fa36..9e8641abcff 100644 --- a/components/security/secure_tools.rst +++ b/components/security/secure_tools.rst @@ -1,47 +1,39 @@ -Securely Generating Random Numbers +Securely Generating Random Strings ================================== The Symfony Security component comes with a collection of nice utilities related to security. These utilities are used by Symfony, but you should also use them if you want to solve the problem they address. -Generating a Secure random Number -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +Generating a Secure random +~~~~~~~~~~~~~~~~~~~~~~~~~~ Whenever you need to generate a secure random number, you are highly -encouraged to use the Symfony -:class:`Symfony\\Component\\Security\\Core\\Util\\SecureRandom` class:: +encouraged to use the +:phpfunction:`random_bytes` function:: - use Symfony\Component\Security\Core\Util\SecureRandom; + $random = random_bytes(10); - $generator = new SecureRandom(); - $random = $generator->nextBytes(10); +The function returns a random string, suitable for cryptographic use, of +the number bytes passed as an argument (10 in the above example). -The -:method:`Symfony\\Component\\Security\\Core\\Util\\SecureRandom::nextBytes` -method returns a random string composed of the number of characters passed as -an argument (10 in the above example). - -The SecureRandom class works better when OpenSSL is installed. But when it's -not available, it falls back to an internal algorithm, which needs a seed file -to work correctly. Just pass a file name to enable it:: - - use Symfony\Component\Security\Core\Util\SecureRandom; - - $generator = new SecureRandom('/some/path/to/store/the/seed.txt'); +.. note:: - $random = $generator->nextBytes(10); - $hashedRandom = md5($random); // see tip below + PHP 7 and up provide the ``random_bytes()`` function natively, for older + versions of PHP a polyfill is provided by the `Symfony Polyfill Component`_ + and the `paragonie/random_compat package`_. -.. note:: +.. versionadded:: 2.8 - If you're using the Symfony Framework, you can get a secure random number - generator via the ``security.secure_random`` service. + The `paragonie/random_compat package`_ was added as a dependancy of the Symfony Security Component in 2.8. You will need to manually require the package as a dependancy of your project in versions of Symfony prior to 2.8. .. tip:: - The ``nextBytes()`` method returns a binary string which may contain the + The ``random_bytes()`` function returns a binary string which may contain the ``\0`` character. This can cause trouble in several common scenarios, such as storing this value in a database or including it as part of the URL. The - solution is to hash the value returned by ``nextBytes()`` (to do that, you + solution is to hash the value returned by ``random_bytes()`` (to do that, you can use a simple ``md5()`` PHP function). + +.. _`Symfony Polyfill Component`: https://github.com/symfony/polyfill +.. _`paragonie/random_compat package`: https://github.com/paragonie/random_compat