search

rshf / oauth

Automatically exported from code.google.com/p/oauth
0 stars 0 forks source link

java: net.oauth.OAuthMessage uses unsafe method for nonce generation #248

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago 
Currently OAuthMessages are containing a nonce that is generated from 
System.nanoTime(). This is an unfortunate choice, given that OAuth spec 
requires the timestamp+nonce combination to be unique.

The javadoc says about nanoTime: "This method provides nanosecond precision, 
but not necessarily nanosecond resolution (that is, how frequently the value 
changes) 
- no guarantees are made except that the resolution is at least as good as that 
of currentTimeMillis()."

If we take this into account, the chances are very likely that timestamp and 
nonce will collide.

What steps will reproduce the problem?
1. create a multi-threaded application that uses net.oauth (e.g. jmeter)
2. run with many threads in parallel generating oauth-signed messages
3. see 401 Unauthorized errors popping up, as there is a good chance that 
nonce/timestamp contain duplicates.

What is the expected output? What do you see instead?
I want to see a reduced chance of colliding timestamp+nonce combinations. To do 
so we need to change the nonce generation to ensure uniqueness / randomness. 
Suggestion would be to use UUID.randomUUID() 

What version of the product are you using? On what operating system?
20100527 via maven.

Please provide any additional information below.
I found this issue while analyzing OAuth failures using the oauth-jmeter 
plugin. So I forked the project from 
https://github.com/captrespect/jmeter-oauth into 
https://github.com/otrosien/jmeter-oauth and issued a pull request to 
reorganize and improve the code. If you can tell me where I can issue a pull 
request to this issue, please do so, and I'll be happy to provide a patch.

Original issue reported on code.google.com by MailAcc....@gmail.com on 10 May 2014 at 11:49

GoogleCodeExporter commented 9 years ago 
Forgot to mention: I'm using java7 64bit on a windows7 box.

Original comment by MailAcc....@gmail.com on 10 May 2014 at 11:50

GoogleCodeExporter commented 9 years ago 
read http://shipilev.net/blog/2014/nanotrusting-nanotime/ for granularity of 
nanotime on windows.

Original comment by MailAcc....@gmail.com on 15 May 2014 at 10:17