[MYFACES-4373] Use SecureRandom for Token Generation

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.0.25, 2.1.19, 2.2.14, 2.3-next-M5, 3.0.0, 2.3.8
• Assignee: Bill Lucy
• Reporter: Bill Lucy
• Created: 13/Jan/21 18:55
• Updated: 19/Jan/21 11:22
• Resolved: 13/Jan/21 19:55

Description

We should default to using java.security.SecureRandom instead of java.util.Random for ViewState and CSRF token generation.  The default values for the following two props will be updated:

org.apache.myfaces.RANDOM_KEY_IN_CSRF_SESSION_TOKEN to "secureRandom"

org.apache.myfaces.RANDOM_KEY_IN_VIEW_STATE_SESSION_TOKEN to "secureRandom"

And if available

org.apache.myfaces.RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN to "secureRandom"

Issue Links

• links to: GitHub Pull Request #127
• links to: GitHub Pull Request #128
• links to: GitHub Pull Request #129
• links to: GitHub Pull Request #130
• links to: GitHub Pull Request #131
• links to: GitHub Pull Request #132
• links to: GitHub Pull Request #133
• links to: GitHub Pull Request #134
• links to: GitHub Pull Request #136
• links to: GitHub Pull Request #137
• links to: GitHub Pull Request #138
• links to: GitHub Pull Request #139
• links to: GitHub Pull Request #140