[OFBIZ-9966] Secure the login.secret_key_string

• Type: Sub-task
• Status: Closed
• Priority: Minor
• Resolution: Won't Fix
• Affects Version/s: Trunk
• Fix Version/s: 16.11.05, 17.12.01
• Component/s: framework
• Sprint: Bug Crush Event - 21/2/2015
• Assignee: Jacques Le Roux
• Reporter: Jacques Le Roux
• Created: 05/Nov/17 11:26
• Updated: 20/Feb/18 12:09
• Resolved: 20/Feb/18 12:09

Description

When OFBIZ-4983 was implemented I missed that we put the login.secret_key_string as a property in security properties. This should not have been because it eases attackers work.

The recommended way is to have it as a private static final String that can be changed just when compiling using sed and uuidgen. So then the key is temporay and final and it gets quite harder for a possible attacker to use this mean.

Issue Links

• is broken by: OFBIZ-4983 New feature to reclaim a user account - Using Security Questions