Currently we are ignoring the nonce parameter, which is needed to avoid replay attacks.

CommentFileSizeAuthor
#5 add-nonce-2615770-4.patch5.16 KBsteven spasbo
#3 interdiff.txt276 byteskevin.dutra
#3 add-nonce-2615770-3.patch5.16 KBkevin.dutra
#2 add-nonce-2615770-2.patch5.16 KBkevin.dutra

Comments

juampynr created an issue. See original summary.

kevin.dutra’s picture

kevin.dutra commented
Status: Active » Needs review
StatusFileSize
new add-nonce-2615770-2.patch5.16 KB

This should cover nonce handling. I haven't tried to make the time limit configurable for when the nonce values start being forgotten. (That can be part of a followup if really desired. It doesn't look like it was configurable in previous versions either.)

kevin.dutra’s picture

kevin.dutra commented
StatusFileSize
new add-nonce-2615770-3.patch5.16 KB
new interdiff.txt276 bytes

Whoops, wrong condition for the cron cleanup.

mroycroft’s picture

mroycroft commented

I've reviewed the proposed patch. Changes look good!

steven spasbo’s picture

steven spasbo commented
StatusFileSize
new add-nonce-2615770-4.patch5.16 KB

This no longer cleanly applies to 

8.x-2.x

. Patch has been updated.

kevin.dutra’s picture

kevin.dutra commented
Status: Needs review » Fixed

Now that this issue is closed, please review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, please credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.