Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a method for random url/form hash prefixes #25

Open
ddspringle opened this issue Jul 1, 2024 · 1 comment
Open

Add a method for random url/form hash prefixes #25

ddspringle opened this issue Jul 1, 2024 · 1 comment

Comments

@ddspringle
Copy link
Owner

  • Add a method to the SecurityService.cfc that generate unique prefixes for hashed URL and FORM keys ( to replace the static 'v' and 'f' values currently in use) - the method should accept the total chars for the prefixes and default to a-z lowecase chars only.
  • Add a call to Application.cfc to call this function and cache the results for X amount of time (day(s)) and store them in an application scoped variable
  • Modify the BaseBean getUidHash() functions to utilize the application scoped variable for each type (url and form) in place of the static 'v' and 'f' prefixes used now
  • A minimum cacheTime for these application scoped variables should be set and noted in comments (1 day?) and a recommendation for a scheduled task to update these at slow times to prevent adverse actions happening to actual users during a transition between hash values should be added to both the code and the README.

Purpose of this change is to possible introduce additional variability into the hashed keys to both prevent deep linking (as using the date does now) and to make predicting the patterns used in these obfuscated keys more difficult to attack programatically.

@ddspringle
Copy link
Owner Author

This also opens the door to users simply manually assigning their preferred prefixes for uidHash values directly in Application.cfc

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant