Skip to content

Component API keys uses randomBytes to generate the keys #395

@petruki

Description

@petruki

Is your feature request related to a problem? Please describe.
Currently, API keys are generated using crypto.randomBytes() method is used to generate a cryptographically well-built artificial random data and the number of bytes to be generated in the written code. link-ref

And it looks like something similar to:

REdlREZ0b2d0bVBPLytuTmVjWW1FSk5WRHhtbEtDRUhXRFBITVhFMzdZZz0=

Though secure enough it's not a usual use case for API keys generation.

Describe the solution you'd like
The API Crypto can also provide a randomUUI: a method of the Crypto interface is used to generate a v4 UUID using a cryptographically secure random number generator. link-ref

And it looks like:

5b33229b-3b63-4967-87ef-ddfe6e156326

Switcher API must still be compatible with the old key generated using randomBytes and deprecate this method.
In the future, this validation should be removed from the codebase.

Metadata

Metadata

Assignees

Labels

enhancementNew feature or requestsecurityVulnerability detected

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions