Set the CookieStore key in Auth API Server #1248
Conversation
tekton-robot
added
the
size/S
api/pkg/auth/base.go
Outdated
| key := make([]byte, length) | ||
| _, err := rand.Read(key) | ||
| if err != nil { | ||
| return "SESSION_SECRET" |
There was a problem hiding this comment.
@pratap0007 can you add panic of fatal on error response from generate random key. static key is not advised
@vdemeester @piyush-garg WDYT?
api/pkg/auth/base.go
Outdated
| if err != nil { | ||
| return "SESSION_SECRET" | ||
| } | ||
| return base64.StdEncoding.EncodeToString(key) |
There was a problem hiding this comment.
@pratap0007 Is there any restriction on the key length? encoding it to base64 may result unpredictable key length.
There was a problem hiding this comment.
maximum 64 bytes
pratap0007
force-pushed
the
set-CookieStore-key
branch
from
0518fae to
310e459
Compare
This commit sets CookieStore key to a random string earlier it was empty and due change in `gorilla/securecookie` package CookieStore expects to set the key Signed-off-by: Shiv Verma <shverma@redhat.com>
pratap0007
force-pushed
the
set-CookieStore-key
branch
from
310e459 to
d9fa130
Compare
|
Thanks :) |
tekton-robot
added
the
approved
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: PuneetPunamiya, vinamra28 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Changes
This commit sets CookieStore key to a random string
earlier it was empty and due change in
gorilla/securecookiepackage, CookieStore expects to set the key
Submitter Checklist
These are the criteria that every PR should meet, please check them off as you
review them:
make api-checkmake ui-checkSee the contribution guide for more details.
Release Notes