Sometimes auth plugin blocks on signin

[jacobobryant]

The auth plugin includes the following function, which is used for generating the 6-digit signin codes:

(defn new-code [length]
  (let [rng (java.security.SecureRandom/getInstanceStrong)]
    (format (str "%0" length "d")
            (.nextInt rng (dec (int (Math/pow 10 length)))))))

It turns out that if the machine doesn't have enough entropy stored up, getInstanceStrong will block until it does. On one of my apps (used only by myself), sign-in is occasionally broken due to that. I haven't noticed the problem in any of my public-facing apps. (Also note that this doesn't affect the signin link flow, only the signin code flow.)

If we replace (java.security.SecureRandom/getInstanceStrong) with (java.security.SecureRandom.) then it doesn't block. Need to figure out if the extra security of getInstanceStrong really matters.

As a temporary workaround, you can use this:

(defn new-code [length]
  (let [rng (java.security.SecureRandom.)]
    (format (str "%0" length "d")
            (.nextInt rng (dec (int (Math/pow 10 length)))))))

(alter-var-root #'com.biffweb.impl.auth/new-code (constantly new-code))

[jacobobryant]

Closed by v0.7.11.