Skip to content

Change how tokens and tickets are generated

Ioannis Kakavas requested to merge ikakavas/TEIP-ALservice:master into master

Based on our discussions on https://trello.com/c/Z1guGjzE/34-fix-id-hub-token-generation-issue-token-of-more-than-300-chars-is-way-too-long, I changed how tickets are generated to using a PRNG approach with configurable length instead of hashing. Since the inputs to the hashing algorithm (SHA512) were used only to increase entropy, we could move to generating random strings for tokens and only use input (salt, time, user input) when the system PRNG is not available and we need more entropy. The random string generation is based on how Django generates random tokens.

Merge request reports