ENXF NET
Administrator
Staff member
Administrator
Moderator
+Lifetime VIP+
S.V.I.P.S Member
S.V.I.P Member
V.I.P Member
Collaborate
Registered
- Joined
- Nov 13, 2018
- Messages
- 23,654
- Points
- 823
\XF\Util\Random::getRandomString() generates a cryptographically secure random value (by calling \XF\Util\Random::getRandomBytes()) but then calls base64_encode to generate a string from those bytes.AFAIK,
base64_encode is not constant time so could be vulnerable to timing attacks.It might therefore be better to use
sodium_bin2base64 instead (if available) or fallback to bundled ParagonIE_Sodium_Core_Base64_UrlSafe if not.Continue reading...