-
-
Notifications
You must be signed in to change notification settings - Fork 4.8k
Generate tokens with CSPRNG #372
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Ideally, I'd create a function:
and use it everywhere (removing hat dependency), but don't know where to put it. Should we have |
This is a nice idea, security few! Agreed with a custom function for these things. Feel free to update this PR and we'll happily merge this in, unless @drew-gross has any objections. |
All right, I've introduced |
@dchest updated the pull request. |
I'll rebase it in a few hours. |
Great, looks good so far. Can we use ES6 import/export style by any chance? |
Passing back purely for rebase. |
@dchest updated the pull request. |
@dchest updated the pull request. |
@dchest updated the pull request. |
@dchest updated the pull request. |
Whee! Sorry for the noise, it's ready for review now. With regards to modules, I chose to use whatever import style the file uses: when it's CommonJS-style, I used CommonJS, when it already had ES6 imports, I used ES6 import. The .spec.js files are not transpiled, so I used |
Can you rebase this? Thank you. |
Move object ID, token, and random string generation into their own module, cryptoUtils. Remove hat dependency, which was used to generate session and some other tokens, because it used non-cryptographic random number generator. Replace it with the cryptographically secure one. The result has the same format (32-character hex string, 128 bits of entropy). Remove randomstring dependency, as we already have this functionality. Add tests.
@dchest updated the pull request. |
Generate tokens with CSPRNG
Package hat, used to generate session and some other tokens uses
non-cryptographic random number generator. Replace it with the
cryptographically secure one. The result has the same format
(32-character hex string, 128 bits of entropy).