unserialize() error about dropbox HOT 8 CLOSED

Hi @walkman

I have only encountered this problem when the encryption key is changed after a token has been obtained. As the decryption will fail, so will unserializing the token.

Please confirm that the encryption key was not changed between requests and I will investigate further. Commit 91c6e5a checks for failed unserialisation and throws an Exception which will allow you to handle this error more gracefully.

from dropbox.

Yes, I cahnged it manually to test it. So it will never come up when I request token from a new user ?

from dropbox.

Thanks for the change ! Anyway, your code is very clean and easily usable ! ;-)

from dropbox.

Hi @walkman

This issue will still occur if you encrypt tokens with one key and try to decrypt using another. This means that any change to your encryption key will mean that tokens issued before that change will no longer work. I will look into ways we can handle this, but for now please bear this in mind.

Thank you for the compliments!

Regards,
Ben

from dropbox.

I did not looked into details yet, does it mean you use only one key for every user? I tought the way to use your scripts that I generate every user a unique key and assign to them, and when the user log in I use that key. Am I right ?

from dropbox.

Hi @walkman

It's your decision whether you use a unique encryption key per user or use a shared key. In both scenarios the above applies - you must decrypt with the same key that you encrypted the token with. If at any point a unique/shared key is changed, any tokens encrypted using that key will be useless as you will be unable to decrypt them.

from dropbox.

ok, got it thanks !!

from dropbox.

Hi @walkman

No problem, glad I could help :)

from dropbox.