From 03beda0e5ddac60ddcdf51c673654fff2f199814 Mon Sep 17 00:00:00 2001 From: Denis Arh Date: Mon, 4 Oct 2021 21:20:14 +0200 Subject: [PATCH] Add more randomness to the generated JWTs --- auth/oauth2/jwt_access.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/auth/oauth2/jwt_access.go b/auth/oauth2/jwt_access.go index 620e36264..d24d08fcb 100644 --- a/auth/oauth2/jwt_access.go +++ b/auth/oauth2/jwt_access.go @@ -2,11 +2,12 @@ package oauth2 import ( "context" + "strings" + "github.com/cortezaproject/corteza-server/pkg/rand" "github.com/dgrijalva/jwt-go" "github.com/go-oauth2/oauth2/v4" "github.com/go-oauth2/oauth2/v4/errors" - "strings" ) // NewJWTAccessGenerate create to generate the jwt access token instance @@ -43,6 +44,7 @@ func (a *JWTAccessGenerate) Token(ctx context.Context, data *oauth2.GenerateBasi } token := jwt.NewWithClaims(a.SignedMethod, claims) + token.Header["salt"] = string(rand.Bytes(32)) if a.SignedKeyID != "" { token.Header["kid"] = a.SignedKeyID }