feat: Allows configuring MinParameterEntropy #461
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mitar
commented
Aug 13, 2020
| @@ -111,7 +111,7 @@ var ( | |||
| } | |||
| ErrInsufficientEntropy = &RFC6749Error{ | |||
| Name: errInsufficientEntropyName, | |||
| Description: fmt.Sprintf("The request used a security parameter (e.g., anti-replay, anti-csrf) with insufficient entropy (minimum of %d characters)", MinParameterEntropy), | |||
| Description: "The request used a security parameter (e.g., anti-replay, anti-csrf) with insufficient entropy", | |||
There was a problem hiding this comment.
It is not necessary to have the minimal length here because we pass a similar message (with minimal length) as a hint as well.
mitar
force-pushed
the
config-min-entropy
branch
from
5f65c17
to
66f3371
Compare
aeneasr
approved these changes
Aug 21, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Related issue
Fixes #267.
Proposed changes
Added
MinParameterEntropytocompose.Configandfosite.Fosite(and few other structs) which then controls the minimal length of the parameters which should have entropy.Checklist
vulnerability. If this pull request addresses a security vulnerability, I
confirm that I got green light (please contact
security@ory.sh) from the maintainers to push
the changes.
Further comments
There are quite a few extra changes to tests to make it a bit easier to control this config variable. I somehow disliked the idea of the global state between various test cases and that previous test case's
MinParameterEntropyvalue would influence later ones. So I made functions to create new instances of objects as needed.