This is an automated email from the ASF dual-hosted git repository.
jungm pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomee.git
The following commit(s) were added to refs/heads/main by this push:
new cf27717d52 use secure random for OIDC nonce/state
cf27717d52 is described below
commit cf27717d523d700d4f8f8a4ec3f86a401bb54c42
Author: Markus Jung <[email protected]>
AuthorDate: Sat Aug 29 22:09:41 2026 +0200
use secure random for OIDC nonce/state
---
.../cdi/OpenIdAuthenticationMechanism.java | 4 +++-
.../cdi/openid/storage/OpenIdStorageHandler.java | 15 ++++++++++----
.../impl/CookieBasedOpenIdStorageHandlerTest.java | 24 ++++++++++++++++++++++
3 files changed, 38 insertions(+), 5 deletions(-)
diff --git
a/tomee/tomee-security/src/main/java/org/apache/tomee/security/cdi/OpenIdAuthenticationMechanism.java
b/tomee/tomee-security/src/main/java/org/apache/tomee/security/cdi/OpenIdAuthenticationMechanism.java
index eee2658da8..e4487027d5 100644
---
a/tomee/tomee-security/src/main/java/org/apache/tomee/security/cdi/OpenIdAuthenticationMechanism.java
+++
b/tomee/tomee-security/src/main/java/org/apache/tomee/security/cdi/OpenIdAuthenticationMechanism.java
@@ -55,6 +55,7 @@ import java.io.IOException;
import java.net.URI;
import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
import java.util.Arrays;
import java.util.Base64;
import java.util.stream.Collectors;
@@ -310,7 +311,8 @@ public class OpenIdAuthenticationMechanism implements
HttpAuthenticationMechanis
return
messageContext.notifyContainerAboutLogin(CredentialValidationResult.NOT_VALIDATED_RESULT);
}
- if (!state.equals(storageHandler.getStoredState(request,
response))) {
+ if (!MessageDigest.isEqual(state.getBytes(StandardCharsets.UTF_8),
+ storageHandler.getStoredState(request,
response).getBytes(StandardCharsets.UTF_8))) {
return
messageContext.notifyContainerAboutLogin(CredentialValidationResult.INVALID_RESULT);
}
diff --git
a/tomee/tomee-security/src/main/java/org/apache/tomee/security/cdi/openid/storage/OpenIdStorageHandler.java
b/tomee/tomee-security/src/main/java/org/apache/tomee/security/cdi/openid/storage/OpenIdStorageHandler.java
index 6b281b0274..d69c452197 100644
---
a/tomee/tomee-security/src/main/java/org/apache/tomee/security/cdi/openid/storage/OpenIdStorageHandler.java
+++
b/tomee/tomee-security/src/main/java/org/apache/tomee/security/cdi/openid/storage/OpenIdStorageHandler.java
@@ -16,15 +16,16 @@
*/
package org.apache.tomee.security.cdi.openid.storage;
-import org.apache.commons.lang3.RandomStringUtils;
-
import
jakarta.security.enterprise.authentication.mechanism.http.OpenIdAuthenticationMechanismDefinition;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
+import java.security.SecureRandom;
+import java.util.Base64;
import java.util.function.Supplier;
public abstract class OpenIdStorageHandler {
protected static final String PREFIX = "openid.";
+ private static final SecureRandom RANDOM = new SecureRandom();
public static final String REQUEST_KEY = "REQUEST";
public static final String STATE_KEY = "STATE";
@@ -73,7 +74,7 @@ public abstract class OpenIdStorageHandler {
}
public String createNewState(HttpServletRequest request,
HttpServletResponse response) {
- String state = RandomStringUtils.random(10, true, true);
+ String state = newToken();
set(request, response, STATE_KEY, state);
return state;
@@ -84,9 +85,15 @@ public abstract class OpenIdStorageHandler {
}
public String createNewNonce(HttpServletRequest request,
HttpServletResponse response) {
- String nonce = RandomStringUtils.random(10, true, true);
+ String nonce = newToken();
set(request, response, NONCE_KEY, nonce);
return nonce;
}
+
+ static String newToken() {
+ final byte[] bytes = new byte[32];
+ RANDOM.nextBytes(bytes);
+ return Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
+ }
}
diff --git
a/tomee/tomee-security/src/test/java/org/apache/tomee/security/cdi/openid/storage/impl/CookieBasedOpenIdStorageHandlerTest.java
b/tomee/tomee-security/src/test/java/org/apache/tomee/security/cdi/openid/storage/impl/CookieBasedOpenIdStorageHandlerTest.java
index 98189e8b77..c6a49f612b 100644
---
a/tomee/tomee-security/src/test/java/org/apache/tomee/security/cdi/openid/storage/impl/CookieBasedOpenIdStorageHandlerTest.java
+++
b/tomee/tomee-security/src/test/java/org/apache/tomee/security/cdi/openid/storage/impl/CookieBasedOpenIdStorageHandlerTest.java
@@ -27,6 +27,8 @@ import org.mockito.ArgumentCaptor;
import java.nio.charset.StandardCharsets;
import java.util.Base64;
+import java.util.HashSet;
+import java.util.Set;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNotEquals;
@@ -140,4 +142,26 @@ public class CookieBasedOpenIdStorageHandlerTest {
verify(response).addCookie(captor.capture());
return captor.getValue();
}
+
+ @Test
+ public void createNewStateProducesLongUniqueUrlSafeTokens() {
+ final Set<String> seen = new HashSet<>();
+ for (int i = 0; i < 1000; i++) {
+ final String state = handler.createNewState(request, response);
+ assertEquals(43, state.length());
+ assertTrue(state.matches("[A-Za-z0-9_-]+"));
+ assertTrue(seen.add(state));
+ }
+ }
+
+ @Test
+ public void createNewNonceProducesLongUniqueUrlSafeTokens() {
+ final Set<String> seen = new HashSet<>();
+ for (int i = 0; i < 1000; i++) {
+ final String nonce = handler.createNewNonce(request, response);
+ assertEquals(43, nonce.length());
+ assertTrue(nonce.matches("[A-Za-z0-9_-]+"));
+ assertTrue(seen.add(nonce));
+ }
+ }
}
