|
Encryption of session information
<?php
require_once HORDE_BASE . '/lib/Secret.php';
// If we need to set the encryption key, we call:
Secret::setKey($registry->getApp());
// Get the encryption key:
$key = Secret::getKey($registry->getApp());
// Read some sensitive data
$data = Secret::read($key, $privateData);
// Encrypt a new value
$encrypted = Secret::write($key, $plaintext);
?>
- Secret::read() and Secret::write() will use mcrypt if available; otherwise they will use the HCEMD5 module in PEAR.
- The encryption key is stored as a cookie, if possible.
- When the key is a cookie or otherwise not stored on the server, these functions can be used to encrypt data inside session information such that even access to the session store is not enough to gain the information.
|
