Change api_key_plain generation

Text::uuid is not cryptographically secure.
dmnlk · Jan 6, 2018 · 69d01a0 · 69d01a0
1 parent 2b0e76d
commit 69d01a0
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/en/controllers/components/authentication.rst b/en/controllers/components/authentication.rst
@@ -362,6 +362,7 @@ generate these API tokens randomly using libraries from CakePHP::
     use Cake\Utility\Text;
     use Cake\Event\Event;
     use Cake\ORM\Table;
+    use Cake\Utility\Security;
 
     class UsersTable extends Table
     {
@@ -373,7 +374,7 @@ generate these API tokens randomly using libraries from CakePHP::
                 $hasher = new DefaultPasswordHasher();
 
                 // Generate an API 'token'
-                $entity->api_key_plain = sha1(Text::uuid());
+                $entity->api_key_plain = Security::hash(Security::randomBytes(32), 'sha256', false);
 
                 // Bcrypt the token so BasicAuthenticate can check
                 // it during login.