[JBoss JIRA] (GTNPORTAL-2771) Ensure that generated rememberme token is really unique
- First Post
- Replies
- Stats
-
Go to
- ----- 2025 -----
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2024 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
[
https://issues.jboss.org/browse/GTNPORTAL-2771?page=com.atlassian.jira.pl...
]
RH Bugzilla Integration commented on GTNPORTAL-2771:
----------------------------------------------------
vramik(a)redhat.com made a comment on [bug
887972|https://bugzilla.redhat.com/show_bug.cgi?id=887972]
I tried following scenario:
I've used jar with org.exoplatform.web.security.SimpleGeneratorCookieTokenService test
class and configured jpp to use this class instead of original one.
Then I tried to log in wit rememberme checkbox checked and cookie with
"rememberme1" was generated. Then I erased cookies and log in with rememberme
checkbox checked again and cookie with "rememberme2" was generated.
Then I erased cookies and log in with rememberme checkbox checked again and cookie with
"rememberme3" was generated and in log is: 16:06:53,727 DEBUG
[org.exoplatform.web.security.SimpleGeneratorCookieTokenService] (http-/127.0.0.1:8080-2)
Token rememberme2 already exists. Other token will be generated
Ensure that generated rememberme token is really unique
-------------------------------------------------------
Key: GTNPORTAL-2771
URL: https://issues.jboss.org/browse/GTNPORTAL-2771
Project: GateIn Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Reporter: Marek Posolda
Assignee: Marek Posolda
Labels: EPP6.0-Test-Dev
Fix For: 3.6.0.Final
Currently we are generating random rememberme tokens based on random int number
(random.nextInt()). In systems with millions or many thousands login, this discriminator
is not enough.
We should improve it and fix it either by:
1) Ensure that generated token is really unique. In system with many logins the random
number may not be unique enough, so we need to add other info (like
System.currentTimeMillis() or counter or both...)
2) In case that token already exists, we should generate other one instead of refresh the
current one.
Maybe combination of both approaches would be best :-)
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
4655
days inactive
4655
days old
0 comments
1 participants
tags (0)
participants (1)
-
RH Bugzilla Integration (JIRA)