You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Add a method to the SecurityService.cfc that generate unique prefixes for hashed URL and FORM keys ( to replace the static 'v' and 'f' values currently in use) - the method should accept the total chars for the prefixes and default to a-z lowecase chars only.
Add a call to Application.cfc to call this function and cache the results for X amount of time (day(s)) and store them in an application scoped variable
Modify the BaseBean getUidHash() functions to utilize the application scoped variable for each type (url and form) in place of the static 'v' and 'f' prefixes used now
A minimum cacheTime for these application scoped variables should be set and noted in comments (1 day?) and a recommendation for a scheduled task to update these at slow times to prevent adverse actions happening to actual users during a transition between hash values should be added to both the code and the README.
Purpose of this change is to possible introduce additional variability into the hashed keys to both prevent deep linking (as using the date does now) and to make predicting the patterns used in these obfuscated keys more difficult to attack programatically.
The text was updated successfully, but these errors were encountered:
Purpose of this change is to possible introduce additional variability into the hashed keys to both prevent deep linking (as using the date does now) and to make predicting the patterns used in these obfuscated keys more difficult to attack programatically.
The text was updated successfully, but these errors were encountered: