Two issues with it:
- no collision check for the generated random. I don't think it's strong enough to be considered UUID quality and even then, it's hashed and thus collisions of the hash must be eliminated.
- for customer it should never work, cause the tables have foreign keys to admin_user not customer_entity.
More general:
Do we really want to set 10 years expiration time? Or leave that up to the store owner with a more conservative default?
Don't forget that cookies are much less secure: only access to a browser instance (not the phone / authenticator) is required for identity theft.
Two issues with it:
More general:
Do we really want to set 10 years expiration time? Or leave that up to the store owner with a more conservative default?
Don't forget that cookies are much less secure: only access to a browser instance (not the phone / authenticator) is required for identity theft.