Mailing-List: contact dev-help@jackrabbit.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@jackrabbit.apache.org
Date: Wed, 16 Mar 2011 17:43:29 +0000 (UTC)
From: "angela (JIRA)" <jira@apache.org>
To: dev@jackrabbit.apache.org
Message-ID: 
 <1515542553.7028.1300297409769.JavaMail.tomcat@hel.zones.apache.org>
In-Reply-To: 
 <449154551.6657.1300289249598.JavaMail.tomcat@hel.zones.apache.org>
Subject: [jira] Commented: (JCR-2919) Security of token base authentication
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable


    [ https://issues.apache.org/jira/browse/JCR-2919?page=3Dcom.atlassian.j=
ira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D130075=
89#comment-13007589 ]=20

angela commented on JCR-2919:
-----------------------------

> Worse yet, JCR-2857 introduces sequential node ids. Guessing is a piece o=
f cake in such a setup.=20

the token nodes never use sequention node ids.

> Security of token base authentication
> -------------------------------------
>
>                 Key: JCR-2919
>                 URL: https://issues.apache.org/jira/browse/JCR-2919
>             Project: Jackrabbit Content Repository
>          Issue Type: Bug
>          Components: jackrabbit-core, security
>    Affects Versions: 2.3.0
>            Reporter: Michael D=C3=BCrig
>
> Token based authentication as implemented with JCR-2851 seems to exhibit =
a security issue: the token returned by the server consists of the identifi=
er of a (newly created) node in the repository. An attacker who is able to =
guess (or acquire by other means i.e. via log files) that identifier will b=
e granted access to the repository. Worse yet, JCR-2857 introduces sequenti=
al node ids. Guessing is a piece of cake in such a setup.
> I think we should decouple authentication secrets from node ids. A simple=
 solution would be to store the secret in a token attribute and delegate ge=
neration of the secret to a dedicated handler. Such a handler can then use =
a secure random generator, private/public key encryption or whatever other =
method that is deemed appropriate to generate the authentication secret.=20
> Initial discussion see: http://markmail.org/thread/aspetgvmj2qud25a

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira