php-openid
php-openid copied to clipboard
Timestamp not included in memcached-Nonce-Store
When using memcached as store for nonces only the salt is included so that the nonce might not be unique any more if an implementation (e.g. openid4java standard implementation) uses the timestamp followed by a counter.
return $this->connection->add( 'openid_nonce_' . sha1($server_url) . '_' . sha1($salt), 1, // any value here $this->compress, $Auth_OpenID_SKEW);
could be modified to:
return $this->connection->add( 'openid_nonce_' . sha1($server_url) . '_' . sha1($timestamp.$salt), 1, // any value here $this->compress, $Auth_OpenID_SKEW);
to fix that in Auth/OpenID/MemcachedStore.php