From 6782b243aecab15f26b52c059bde0021d0a5a1df Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20Pablo=20Villaf=C3=A1=C3=B1ez?= Date: Wed, 23 Oct 2024 11:02:34 +0200 Subject: [PATCH] feat: switch to md5 + timestamp MD5 will make the token shorter. The timestamp will help to prevent collisions since the tokens must be generated at the same nanosecond (assuming the md5 sum generates the same hash, which is unlikely). Using MD5 shouldn't be a security issue. The "real" access token is already encrypted, and it's visible and accessible if short tokens aren't used. --- services/collaboration/pkg/middleware/wopicontext.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/services/collaboration/pkg/middleware/wopicontext.go b/services/collaboration/pkg/middleware/wopicontext.go index 09a1774d64..34378ae03f 100644 --- a/services/collaboration/pkg/middleware/wopicontext.go +++ b/services/collaboration/pkg/middleware/wopicontext.go @@ -2,11 +2,12 @@ package middleware import ( "context" - "crypto/sha256" + "crypto/md5" "encoding/hex" "errors" "fmt" "net/http" + "strconv" "strings" "time" @@ -213,9 +214,9 @@ func GenerateWopiToken(wopiContext WopiContext, cfg *config.Config, st microstor accessToken, err := token.SignedString([]byte(cfg.Wopi.Secret)) if cfg.Wopi.ShortTokens { - c := sha256.New() + c := md5.New() c.Write([]byte(accessToken)) - shortAccessToken := hex.EncodeToString(c.Sum(nil)) + shortAccessToken := hex.EncodeToString(c.Sum(nil)) + strconv.FormatInt(time.Now().UnixNano(), 16) errWrite := st.Write(µstore.Record{ Key: shortAccessToken,