By piccoloprincipe
via paul-m-jones.com
Submitted: Feb 13 2013 / 14:18
On the pages for rand() and uniqid(), as well as looking at the C code, they specifically state that these functions should not be used for generating secure tokens. They tend to generate predictable values. And the documentation for md5() states that it should not be used for password hashing. Granted we’re not hashing passwords when creating a CSRF token, but with the tooling available shouldn’t we be using functions that are more cryptographically secure?
Add your comment
