generate cryptographically secure state token

owncloud · Jan 13, 2021 · f230ea7 · f230ea7
1 parent 1721b78
commit f230ea7
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 1 deletion.
diff --git a/changelog/unreleased/generate-secure-state.md b/changelog/unreleased/generate-secure-state.md
@@ -0,0 +1,7 @@
+Change: generate cryptographically secure state token 
+
+Replaced Math.random with a cryptographically secure way to generate the oidc state token using the javascript crypto api. 
+
+https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues
+https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Math/random
+https://github.com/owncloud/ocis/pull/1203
diff --git a/konnectd/ui/src/utils.js b/konnectd/ui/src/utils.js
@@ -1,5 +1,9 @@
 export function withClientRequestState(obj) {
-  obj.state = Math.random().toString(36).substring(7);
+  // Generate a 16 byte random token
+  const values = new Uint8Array(16);
+  crypto.getRandomValues(values);
+  // Convert the 16 byte to a hex string and assign to the state attribute
+  obj.state = Array.prototype.map.call(values, x => x.toString(16)).join('');
 
   return obj;
 }