Fail closed when CSPRNG is unavailable during nonce generation

[dknauss]

Summary

This PR replaces the weak fallback in create_login_nonce() with a hard failure.

The existing fallback uses wp_hash() with inputs including $user_id, wp_rand(), and microtime(). That defensive path dates back to the PHP 5.x / random_compat era. On the plugin’s current minimum PHP version (7.2+), random_bytes() should use the OS CSPRNG and should not fail under normal conditions.

If secure randomness is unavailable, failing closed is safer than generating a weaker nonce. Both existing call sites already handle a false return with wp_die().

Change

try {
    $login_nonce['key'] = bin2hex( random_bytes( 32 ) );
} catch ( Exception $ex ) {
-   $login_nonce['key'] = wp_hash( $user_id . wp_rand() . microtime(), 'nonce' );
+   return false;
}

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: dknauss <dpknauss@git.wordpress.org>
Co-authored-by: masteradhoc <masteradhoc@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[Copilot]

Pull request overview

This PR hardens Two_Factor_Core::create_login_nonce() by removing the weak entropy fallback used when random_bytes() fails and instead returning false, ensuring nonce generation fails closed when a CSPRNG is unavailable.

Changes:

• Replace the wp_hash( $user_id . wp_rand() . microtime(), 'nonce' ) fallback with return false when random_bytes() throws.
• Preserve existing caller behavior: both in-file call sites already treat a false return as fatal via wp_die().

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[masteradhoc]

@dknauss any reason to close it?

[dknauss]

Whoops, that was unintentional — it must have gotten swept up in some automated cleanup I was doing across several repos. Restoring/reopening.