Browse Source

fix insecure math/rand use for access token generation (#1441)

pull/1448/head
Tim Cooper 4 years ago committed by GitHub
parent
commit
3717a2ebeb
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
  1. 6
      utils/accessTokens.go

6
utils/accessTokens.go

@ -1,9 +1,8 @@ @@ -1,9 +1,8 @@
package utils
import (
"crypto/rand"
"encoding/base64"
"math/rand"
"time"
)
const tokenLength = 32
@ -19,8 +18,7 @@ func GenerateAccessToken() (string, error) { @@ -19,8 +18,7 @@ func GenerateAccessToken() (string, error) {
// case the caller should not continue.
func generateRandomBytes(n int) ([]byte, error) {
b := make([]byte, n)
rand.Seed(time.Now().UTC().UnixNano())
_, err := rand.Read(b) //nolint
_, err := rand.Read(b)
// Note that err == nil only if we read len(b) bytes.
if err != nil {
return nil, err

Loading…
Cancel
Save