symfony/symfony — pull request #8195 by joncave (2013-06-04 15:57:41+00:00)
Title: [Security] Use HMAC construction for remember me cookie hashes

[Security] Use HMAC construction for remember me cookie hashes

| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| License | MIT

HMAC is a more secure construction for MACs than the secret suffix method that is currently being used by the remember me cookies, see http://rdist.root.org/2009/10/29/stop-using-unsafe-keyed-hashes-use-hmac/.

Changing the MAC scheme means that current cookies will be invalidated and users will have to login again. Though there are no API BC issues.