From 6d4cd2c3353c6d94a3d29f675388e647788a83c3 Mon Sep 17 00:00:00 2001 From: Max Resnick Date: Sat, 29 Mar 2025 16:29:49 -0700 Subject: feat: upgrade token security, upgrade go, packages, fix linting issues Token generation changes: 1. Increasing to 32 bytes (256 bits) of entropy 2. Using crypto/rand.Read directly instead of loop --- internal/authz/model.go | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) (limited to 'internal/authz/model.go') diff --git a/internal/authz/model.go b/internal/authz/model.go index c43a159..0c55c15 100644 --- a/internal/authz/model.go +++ b/internal/authz/model.go @@ -6,12 +6,14 @@ import ( "encoding/hex" "fmt" "log/slog" - "math/big" "os" "golang.org/x/crypto/bcrypt" ) +// TokenSize is the number of random bytes used for token generation +const TokenSize = 32 + // NewTokenMap create a new token map func NewTokenMap() TokenMap { return TokenMap{} @@ -42,17 +44,16 @@ func (tm TokenMap) LoadTokensFromFile(path string) error { return err } -// GenerateNewToken generate a new token +// GenerateNewToken generates a new secure random token and its bcrypt hash +// The token is 32 bytes (256 bits) of cryptographically secure random data +// encoded as a 64-character hex string. The hash is a bcrypt hash of the +// random bytes using default cost parameters. func GenerateNewToken() (string, string, error) { - tokenBytes := make([]byte, 28) - for i := range tokenBytes { - maxInt := big.NewInt(int64(255)) - randInt, err := rand.Int(rand.Reader, maxInt) - if err != nil { - return "", "", err - } - tokenBytes[i] = uint8(randInt.Int64()) + tokenBytes := make([]byte, TokenSize) + if _, err := rand.Read(tokenBytes); err != nil { + return "", "", fmt.Errorf("failed to generate random token: %w", err) } + hashBytes, err := bcrypt.GenerateFromPassword(tokenBytes, bcrypt.DefaultCost) if err != nil { return "", "", err -- cgit v1.2.3