Skip to main content

Insecurely generated token

Need​

Secure token generation mechanism

Context​

  • Usage of Java 8 for developing applications with enhanced features and performance
  • Usage of java.util.Random for generating random numbers in Java
  • Usage of javax.servlet.http.Cookie for handling HTTP cookies in Java Servlets
  • Usage of javax.servlet.http.HttpServletRequest for handling HTTP requests in Java Servlets
  • Usage of HttpServletResponse for handling HTTP responses in Java Servlet applications

Description​

Non compliant code​

import java.util.Random;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class TokenGenerator {
    public void generateToken(HttpServletRequest request, HttpServletResponse response) {
        Random random = new Random();
        String token = Long.toString(random.nextLong(), 16);
        Cookie cookie = new Cookie("token", token);
        response.addCookie(cookie);
    }
}

In this code snippet, we have a method generateToken which generates a token using the Random class in Java and sets it in a cookie.

The Random class is not a secure way to generate tokens because it uses a linear congruential pseudorandom number generator, which is not cryptographically strong. This means that the generated tokens can be predicted and cracked by an attacker, leading to potential security risks.

The Random.nextLong() method generates a pseudorandom long value. This value is then converted to a base 16 (hexadecimal) string using Long.toString(). The result is a token that is not securely random.

Finally, a new cookie is created with the name "token" and the insecurely generated token value. This cookie is added to the HTTP response, which is then sent back to the client. If an attacker can predict or crack the token, they can potentially impersonate the user, leading to session hijacking or other types of attacks.

Steps​

  • Use a secure cryptographic mechanism to generate the token
  • Use a cryptographically secure random number generator
  • Ensure the token has sufficient entropy
  • Consider using a library or framework that provides secure token generation

Compliant code​

import java.security.SecureRandom;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.math.BigInteger;

public class TokenGenerator {
    public void generateToken(HttpServletRequest request, HttpServletResponse response) {
        SecureRandom secureRandom = new SecureRandom();
        String token = new BigInteger(130, secureRandom).toString(32);
        Cookie cookie = new Cookie("token", token);
        response.addCookie(cookie);
    }
}

The original code was using java.util.Random to generate a token, which is not secure as it does not provide a sufficient level of entropy and can be predictable, making it easier for an attacker to guess the token.

The fixed code uses java.security.SecureRandom instead, which is a cryptographically strong random number generator (RNG). The SecureRandom class provides a cryptographically strong random number generator (RNG).

The BigInteger class is used to generate a random number with 130 bits of randomness. This is equivalent to a 39-digit number, or a 32-character string when represented in base 32, providing a high level of entropy and making the token very difficult to guess.

The token is then set as a cookie in the user's response, just like in the original code. However, the token is now much more secure.

References​

Last updated on