Member Avatar for chaitu11 
I am using codeigniter 3
And i am trying to build stay signing functionality
In hash_hmac() i am passing an array , but i want to convert it into a string ,
Can any one tell me how to convert it?

     /*
            | ---------------------------------------------------------------------------
            | REMEMBER ME TOKEN
            | ---------------------------------------------------------------------------
            | When a user logs in and selects the remember me option then you will generate a key using PHP's hash_hmac function. 
            | The data will be the IP address, browser name, username and password and the key (hash_hmac's 3rd parameter) 
            | will be a random string of any length you desire. 
            | The algorithm can be bcrypt/SHA512/crypt/etc.. This should give you a key of 128 characters in length. 
            | Store this key within the table RememberMe. 
            | Table contains user ID, 128 char long key ,expiry date of the key.      

            */

                 if($remember_me == TRUE){


                    $this->load->library('user_agent');

                    $user_agent = $this->agent->browser();
                    $user_agent_version = $this->agent->version();
                    $ip = $this->input->ip_address();

                    $rand128_hex = bin2hex(openssl_random_pseudo_bytes(16));


                    $data = array(
                            'ip' => $ip,
                            'user_agent' => $user_agent,
                            'email' => $email,
                            'password' => $password
                        );

                    echo hash_hmac('crypt', $data, $rand128_hex);



                 }
Edited by chaitu11
  • 2 Contributors
  • 1 Reply
  • 2K Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by Member #120589

Dani AI

Generated

the warning is accurate: hash_hmac() wants the message as a string, not an array. Also, "crypt" is not a valid HMAC algorithm name; use something like "sha256" or "sha512" from hash_hmac_algos(). See the PHP manual for the required parameters and supported algorithms. (php.net)

@diafol’s idea of joining values will work, but it is fragile because array order can change. A safer approach is to build a canonical string, then HMAC it. For example:

ksort($data); // ensure a stable key order
$payload = http_build_query($data, '', '&', PHP_QUERY_RFC3986);
$mac = hash_hmac('sha256', $payload, $secret); // hex by default

ksort() gives you a deterministic order; http_build_query() turns the array into a stable string; and hash_hmac() computes the MAC. Alternatively, serialize with json_encode() before hashing if you prefer JSON. (php.net)

Security notes you will want to consider:

  • Do not include the user’s password in any remember-me cookie. Persistent authentication should never store a password client-side; use a random token-based design instead. A common pattern is a selector:validator pair where only a hash of the validator is stored server-side. Compare with hash_equals() to avoid timing leaks. (owasp.org)
  • If you hex-encode random bytes for keys or tokens, remember hex doubles the length: 16 bytes become 32 hex chars. If you truly need 128 hex chars, generate 64 bytes. (php.net)

That should fix the type error and make the token generation both deterministic and safer.

Member Avatar for Member #120589

Not quite sure what you're looking for - but I'm assuming it's to implode the array to a string:

$dataString = implode($data);
echo hash_hmac('crypt', $dataString, $rand128_hex);
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.