yuanbiao
/
emqx
1
0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #7759 from zmstone/fix-improve-app-secret-randomisation 

fix(emqx_mgmt_auth): randomise all bytes in app secret
This commit is contained in:
Zaiming (Stone) Shi 2022-04-25 16:54:19 +01:00 committed by GitHub
parent f7f1b0ecbf 0dd48e30b6
commit 0d43bd6243
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGES-4.3.md
View File

@ -17,6 +17,7 @@ File format:
* Made possible for EMQX to boot from a Linux directory which has white spaces in its path. * Made possible for EMQX to boot from a Linux directory which has white spaces in its path.
* Add support for JWT authorization [#7596] * Add support for JWT authorization [#7596]
Now MQTT clients may be authorized with respect to a specific claim containing publish/subscribe topic whitelists. Now MQTT clients may be authorized with respect to a specific claim containing publish/subscribe topic whitelists.
* Better randomisation of app screts (changed from timestamp seeded sha hash (uuid) to crypto:strong_rand_bytes)
### Bug fixes ### Bug fixes
* List subscription topic (/api/v4/subscriptions), the result do not match with multiple conditions. * List subscription topic (/api/v4/subscriptions), the result do not match with multiple conditions.

7
apps/emqx_management/src/emqx_mgmt_auth.erl
View File

@ -138,8 +138,11 @@ generate_appsecret_if_need(InSecrt) when is_binary(InSecrt), byte_size(InSecrt)
generate_appsecret_if_need(_) -> generate_appsecret_if_need(_) ->
AppConf = application:get_env(?APP, application, []), AppConf = application:get_env(?APP, application, []),
case proplists:get_value(default_secret, AppConf) of case proplists:get_value(default_secret, AppConf) of
undefined -> emqx_guid:to_base62(emqx_guid:gen()); undefined ->
Secret when is_binary(Secret) -> Secret Random = crypto:strong_rand_bytes(32),
emqx_base62:encode(Random);
Secret when is_binary(Secret) ->
Secret
end. end.
-spec(get_appsecret(appid()) -> {appsecret() | undefined}). -spec(get_appsecret(appid()) -> {appsecret() | undefined}).