Merged
Conversation
* created "create vault" component
until we solve server-side redirects to index.html
* Separate db of development/testing and production * Remove static uuid of admin in production but instead use a separate keycloak config file for development
If the user is still authenticated but the session token is expired, we get 401 status codes when executing requests. We need to refresh the token as long as we allowed until the user is logged out. For more details see https://stackoverflow.com/questions/43422542/keycloak-js-automatic-token-refesh
[ci skip]
![sonatype-lift[bot]](https://avatars.githubusercontent.com/in/9843?s=60&v=4){kind=small}
| */ | ||
| export function uuid(): string { | ||
| return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function (c) { | ||
| var r = Math.random() * 16 | 0, v = c == 'x' ? r : (r & 0x3 | 0x8); |
There was a problem hiding this comment.
opt.semgrep.node_insecure_random_generator: crypto.pseudoRandomBytes()/Math.random() is a cryptographically weak random number generator.
(at-me in a reply with help or ignore)
Member
Author
There was a problem hiding this comment.
@sonatype-lift ignore
this uuid is just used to create vault ids, which aren't involved in anything security-related
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This completes the unlock workflow by computing and storing a device-specific masterkey, i.e. the vault owner re-encrypts the masterkey using the public key of a certain trusted device.
The public key gets stored on first contact of the device (further device verification may be added later).
During unlock the device retrieves the key from via a callback URL which it will listen to on localhost (compatable to RFC 8252 section 7.3).