New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Encryption Key algorithm #14523

Closed
wezell opened this Issue May 30, 2018 · 3 comments

Comments

Projects
None yet
4 participants
@wezell
Contributor

wezell commented May 30, 2018

dotCMS encryptor / unencryptor uses an old and broken algos to encrypt userIds in the jwt token. We need to use a more modern algorithm to regenerate the default encryption key

wezell added a commit that referenced this issue May 30, 2018

@wezell wezell added this to the Cody Next milestone May 31, 2018

@wezell

This comment has been minimized.

Contributor

wezell commented May 31, 2018

To test, null the key from the company, e.g.:

update company set key_=null;

jgambarios added a commit that referenced this issue Jun 1, 2018

Issue 14523 update encryption algo (#14533)
* #14823 update workflow link

* #14523 updates algo to AES and digest to sha256
@jgambarios

This comment has been minimized.

Contributor

jgambarios commented Jun 1, 2018

PR: #14533

@bryanboza

This comment has been minimized.

Contributor

bryanboza commented Jun 1, 2018

Fixed, now we are regenerating the key every time the server starts

@wezell wezell closed this Jun 21, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment