{"action":"created","issue":{"url":"https://api.github.com/repos/thephpleague/oauth2-client/issues/212","labels_url":"https://api.github.com/repos/thephpleague/oauth2-client/issues/212/labels{/name}","comments_url":"https://api.github.com/repos/thephpleague/oauth2-client/issues/212/comments","events_url":"https://api.github.com/repos/thephpleague/oauth2-client/issues/212/events","html_url":"https://github.com/thephpleague/oauth2-client/issues/212","id":55522282,"number":212,"title":"[Proposal] Add CSPRNG's to generate CSRF value","user":{"login":"SammyK","id":578780,"avatar_url":"https://avatars.githubusercontent.com/u/578780?v=3","gravatar_id":"","url":"https://api.github.com/users/SammyK","html_url":"https://github.com/SammyK","followers_url":"https://api.github.com/users/SammyK/followers","following_url":"https://api.github.com/users/SammyK/following{/other_user}","gists_url":"https://api.github.com/users/SammyK/gists{/gist_id}","starred_url":"https://api.github.com/users/SammyK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SammyK/subscriptions","organizations_url":"https://api.github.com/users/SammyK/orgs","repos_url":"https://api.github.com/users/SammyK/repos","events_url":"https://api.github.com/users/SammyK/events{/privacy}","received_events_url":"https://api.github.com/users/SammyK/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-01-26T18:59:37Z","updated_at":"2015-04-15T13:44:51Z","closed_at":null,"body":"Hey guys!\r\n\r\nThe [code that generates the CSRF value](https://github.com/thephpleague/oauth2-client/blob/master/src/Provider/AbstractProvider.php#L123) makes use of `uniqid()` and `rand()` which do not generate **cryptographically secure** pseudo-random values. Since the CSRF (`state`) value is a security feature to guard against [forgery attacks](http://en.wikipedia.org/wiki/Cross-site_request_forgery), it is paramount that the CSRF value is not forgeable (and it currently is.) In order to make this value forge-proof, we need to generate a pseudo-random value that is [cryptographically secure](http://en.wikipedia.org/wiki/Cryptographically_secure_pseudorandom_number_generator).\r\n\r\nPHP particularly sucks at providing CSPRNG's, but there are a few options like [`openssl_random_pseudo_bytes()`](http://php.net/openssl_random_pseudo_bytes) and [`mcrypt_create_iv()`](http://php.net/mcrypt_create_iv). Unfortunately system support for these functions varies.\r\n\r\nWe recently added [injectable CSPRNG's](https://github.com/facebook/facebook-php-sdk-v4/tree/master/src/Facebook/PseudoRandomString) into the Facebook PHP SDK v4.1. Would you like to implement CSPRNG's using a similar method? Or perhaps we could make use of [Anthony Ferrara](https://twitter.com/ircmaxell)'s excellent [RandomLib](https://github.com/ircmaxell/RandomLib) package?\r\n\r\nWhat do you guys think? :)"},"comment":{"url":"https://api.github.com/repos/thephpleague/oauth2-client/issues/comments/93406529","html_url":"https://github.com/thephpleague/oauth2-client/issues/212#issuecomment-93406529","issue_url":"https://api.github.com/repos/thephpleague/oauth2-client/issues/212","id":93406529,"user":{"login":"ramsey","id":42941,"avatar_url":"https://avatars.githubusercontent.com/u/42941?v=3","gravatar_id":"","url":"https://api.github.com/users/ramsey","html_url":"https://github.com/ramsey","followers_url":"https://api.github.com/users/ramsey/followers","following_url":"https://api.github.com/users/ramsey/following{/other_user}","gists_url":"https://api.github.com/users/ramsey/gists{/gist_id}","starred_url":"https://api.github.com/users/ramsey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ramsey/subscriptions","organizations_url":"https://api.github.com/users/ramsey/orgs","repos_url":"https://api.github.com/users/ramsey/repos","events_url":"https://api.github.com/users/ramsey/events{/privacy}","received_events_url":"https://api.github.com/users/ramsey/received_events","type":"User","site_admin":false},"created_at":"2015-04-15T13:44:51Z","updated_at":"2015-04-15T13:44:51Z","body":"It would be nice if the user could inject whatever CSPRNG they like into the library, so that we're not dependent on a single one. This would involve providing an interface and possibly a bundled implementation of an external library using that interface."}}