locker95 opened a new pull request, #13795: URL: https://github.com/apache/apisix/pull/13795
### Description `autogenerate_admin_key()` in `apisix/core/id.lua` used `math.random` to generate the admin key when it is configured as an empty string. `math.random` is a PRNG and not suitable for generating security credentials. This PR replaces it with a CSPRNG: `resty.random.bytes(16, true)`, falling back to `resty.random.bytes(16)` if a strongly-seeded random source is unavailable, encoded with `resty.string.to_hex`. The generated key stays 32 characters long, same as before. This continues #13099 by @sihyeonn, whose approach was approved; the only remaining review request was a test case, but the PR was closed as stale. This PR picks up the same approach (using 16 random bytes instead of 32 to keep the key length unchanged) and adds the requested test: a case in `t/cli/test_admin.sh` that starts APISIX with an empty admin key and asserts the key written back to `conf/config.yaml` is a 32-character hex string. #### Which issue(s) this PR fixes: Fixes #13092 ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [ ] I have updated the documentation to reflect this change (no docs describe the generated key format, so no update is needed) - [x] I have verified that this change is backward compatible -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
