freckle / yesod-auth-oauth2

OAuth2 authentication for yesod
MIT License
71 stars 53 forks source link

Use mwc-random for CSRF state token #134

Closed pbrisbin closed 4 years ago

pbrisbin commented 4 years ago

System.Random uses the system clock as input to the seed, which may expose us to offline attacks. mwc-random does not do this (except as a fallback in rare cases).

Fixes #132.

NOTE: The interface for mwc-random in 0.14 (current resolver) vs 0.15 (latest) is wildly different. So when we attempt to update, we'll have to consider either CPP or extra-deps in old resolvers.

/cc @lf-