php-openid icon indicating copy to clipboard operation
php-openid copied to clipboard

Timestamp not included in memcached-Nonce-Store

Open rkarge opened this issue 13 years ago • 0 comments

When using memcached as store for nonces only the salt is included so that the nonce might not be unique any more if an implementation (e.g. openid4java standard implementation) uses the timestamp followed by a counter.

return $this->connection->add( 'openid_nonce_' . sha1($server_url) . '_' . sha1($salt), 1, // any value here $this->compress, $Auth_OpenID_SKEW);

could be modified to:

return $this->connection->add( 'openid_nonce_' . sha1($server_url) . '_' . sha1($timestamp.$salt), 1, // any value here $this->compress, $Auth_OpenID_SKEW);

to fix that in Auth/OpenID/MemcachedStore.php

rkarge avatar Aug 19 '11 12:08 rkarge