Random not secure, switch to SecureRandom
Gax-c opened this issue · 0 comments
Gax-c commented
Hi, I am new to JustAuth, and when I was browsing the code I found in the file GlobalAuthUtils.java
, Random
is used to generate the nonce here.
public static String generateNonce(int len) {
String s = "0123456789QWERTYUIOPLKJHGFDSAZXCVBNMqwertyuioplkjhgfdsazxcvbnm";
Random rng = new Random();
StringBuilder sb = new StringBuilder();
for (int i = 0; i < len; i++) {
int index = rng.nextInt(62);
sb.append(s, index, index + 1);
}
return sb.toString();
}
However, it's not secure enough, so switching to SecureRandom
can be a better choice.