Question

For example, right now I only need to generate tokens for persistent “remember me” logins. To generate those tokens I am using:

sha1(uniqid(mt_rand(), true))

which always generates 40 characters in [0-9a-f] like so:

64070e8f3d155550b04272eae330d23896e043e6

Can I generate tokens in the same way for password reset functionality and email account verification? In general, is there one token generation mechanism I can use for all my token needs? Or is it likely that I’ll have to use different types of tokens for different needs?

Answer 1

Yes, you can use the same token generator for different purposes. As long as it suits them, you don’t have to mess with different mechanisms, keep it simple