search

wso2 / carbon-apimgt

Apache License 2.0
165 stars 620 forks source link

Change Default Certificate Hashing Algorithm to SHA-256 #12365

Closed hisanhunais closed 3 months ago

hisanhunais commented 3 months ago

Purpose

This PR changes the default certificate hashing algorithm to SHA-256 instead of SHA-1.

The following flows are affected due to this change.

  1. The certificate hashing algorithm used in generating API keys will now use SHA-256 as the hashing algorithm

  2. The certificate hashing algorithm used in generating backend JWTs for JWT and Opaque token SPs will now use SHA-256 as the default hashing algorithm. A config is provided to use SHA-1 as follows.

api-manager.xml.j2

<JWTConfiguration>
    ......
    <!-- Specifies whether to use SHA-1 algorithm to generate the certificate thumbprint -->
    <UseSHA1Hash>{{apim.jwt.use_sha1_hash}}</UseSHA1Hash>
    ......
</JWTConfiguration>

To use SHA-1 instead of SHA-256, the following has to be added to the deployment.toml.

deployment.toml

[apim.jwt]
enable = true
use_sha1_hash = false

[1] https://github.com/wso2/product-apim/pull/13455

codecov[bot] commented 3 months ago

Codecov Report

Attention: Patch coverage is 50.00000% with 13 lines in your changes are missing coverage. Please review.

Project coverage is 41.62%. Comparing base (9471b04) to head (d2a9555). Report is 11 commits behind head on master.

Files Patch % Lines
...apimgt/common/gateway/dto/JWTConfigurationDto.java 20.00% 4 Missing :warning:
...o2/carbon/apimgt/impl/APIManagerConfiguration.java 0.00% 4 Missing :warning:
...wtgenerator/AbstractAPIMgtGatewayJWTGenerator.java 0.00% 2 Missing :warning:
...rbon/apimgt/keymgt/token/AbstractJWTGenerator.java 71.42% 2 Missing :warning:
...so2/carbon/apimgt/common/gateway/util/JWTUtil.java 83.33% 1 Missing :warning:
Additional details and impacted files ```diff @@ Coverage Diff @@ ## master #12365 +/- ## ============================================ + Coverage 36.35% 41.62% +5.26% - Complexity 0 3487 +3487 ============================================ Files 1861 1867 +6 Lines 137447 137934 +487 Branches 19867 19940 +73 ============================================ + Hits 49967 57411 +7444 + Misses 80977 73576 -7401 - Partials 6503 6947 +444 ``` | [Flag](https://app.codecov.io/gh/wso2/carbon-apimgt/pull/12365/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=wso2) | Coverage Δ | | |---|---|---| | [integration_tests](https://app.codecov.io/gh/wso2/carbon-apimgt/pull/12365/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=wso2) | `35.10% <11.53%> (+7.11%)` | :arrow_up: | | [unit_tests](https://app.codecov.io/gh/wso2/carbon-apimgt/pull/12365/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=wso2) | `20.05% <38.46%> (-0.04%)` | :arrow_down: | Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=wso2#carryforward-flags-in-the-pull-request-comment) to find out more.

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.