java: net.oauth.OAuthMessage uses unsafe method for nonce generation
Opened this issue · 2 comments
GoogleCodeExporter commented
Currently OAuthMessages are containing a nonce that is generated from
System.nanoTime(). This is an unfortunate choice, given that OAuth spec
requires the timestamp+nonce combination to be unique.
The javadoc says about nanoTime: "This method provides nanosecond precision,
but not necessarily nanosecond resolution (that is, how frequently the value
changes)
- no guarantees are made except that the resolution is at least as good as that
of currentTimeMillis()."
If we take this into account, the chances are very likely that timestamp and
nonce will collide.
What steps will reproduce the problem?
1. create a multi-threaded application that uses net.oauth (e.g. jmeter)
2. run with many threads in parallel generating oauth-signed messages
3. see 401 Unauthorized errors popping up, as there is a good chance that
nonce/timestamp contain duplicates.
What is the expected output? What do you see instead?
I want to see a reduced chance of colliding timestamp+nonce combinations. To do
so we need to change the nonce generation to ensure uniqueness / randomness.
Suggestion would be to use UUID.randomUUID()
What version of the product are you using? On what operating system?
20100527 via maven.
Please provide any additional information below.
I found this issue while analyzing OAuth failures using the oauth-jmeter
plugin. So I forked the project from
https://github.com/captrespect/jmeter-oauth into
https://github.com/otrosien/jmeter-oauth and issued a pull request to
reorganize and improve the code. If you can tell me where I can issue a pull
request to this issue, please do so, and I'll be happy to provide a patch.
Original issue reported on code.google.com by MailAcc....@gmail.com
on 10 May 2014 at 11:49
GoogleCodeExporter commented
Forgot to mention: I'm using java7 64bit on a windows7 box.
Original comment by MailAcc....@gmail.com
on 10 May 2014 at 11:50
GoogleCodeExporter commented
read http://shipilev.net/blog/2014/nanotrusting-nanotime/ for granularity of
nanotime on windows.
Original comment by MailAcc....@gmail.com
on 15 May 2014 at 10:17