ddspringle / framework-one-secure-auth

An example fw/1 application with secure single and two-factor (2FA) authentication and session management functions
Apache License 2.0
31 stars 5 forks source link

Add a method for random url/form hash prefixes #25

Open ddspringle opened 4 months ago

ddspringle commented 4 months ago

Purpose of this change is to possible introduce additional variability into the hashed keys to both prevent deep linking (as using the date does now) and to make predicting the patterns used in these obfuscated keys more difficult to attack programatically.

ddspringle commented 4 months ago

This also opens the door to users simply manually assigning their preferred prefixes for uidHash values directly in Application.cfc