use HMAC-SHA256 for the cookie string

[briskt]

IDP-2186 Verify and fix bcrypt in sspbase

---

Fixed

• Use HMAC-SHA256 for the cookie string to avoid bcrypt's 72-char limit.

[hobbitronics]

looks good

[briskt]

@devon-sil do you think this will be a change that requires an email blast? It will cause everyone to be prompted for MFA on their next login.

[Copilot]

Pull request overview

This PR updates the MFA “remember me” cookie hashing/verification logic to avoid bcrypt’s 72-character input limit by switching to an HMAC-based approach for cookie integrity checking.

Changes:

• Replace password_hash/password_verify with hash_hmac('sha256', ...) + hash_equals() for remember-me cookie validation.
• Update generateRememberMeCookieString() to no longer embed the secret in the string being hashed.
• Adjust the MFA unit test to generate the cookie hash using HMAC-SHA256.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
modules/mfa/src/Auth/Process/Mfa.php	Switch remember-me cookie hashing/verification to HMAC-SHA256 and update cookie string generation accordingly.
modules/mfa/tests/MfaTest.php	Update test to reflect the new remember-me cookie hashing method.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.