这个身份验证令牌ssl实现是否安全

Question

<?php

define('AES_256_CBC', 'aes-256-cbc');

// both stored in a file on server
$encryption_key = openssl_random_pseudo_bytes(32); 
$iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length(AES_256_CBC)); 

$user_id = 1123;
$exp     = time() + (365 * 24 * 60 * 60);

$data = [
    "user_id" => $user_id,
    "exp"     => $exp,
];
$json = json_encode($data);

$token = openssl_encrypt($json, AES_256_CBC, $encryption_key, 0, $iv);
$base = base64_encode($token);
// at this point send the token to the client to use for further auth
$tokenDecoded = base64_decode($base);
$clear = openssl_decrypt($tokenDecoded, AES_256_CBC, $encryption_key, 0, $iv);
$sessionData = json_decode($clear);

?>

所有内容都通过带有签名证书的SSL HTTPS连接进行。