From 604889b12997c27f87bc956bba419aaeb8ac35ec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?K=C3=A9vin=20Chalet?= Date: Mon, 12 Dec 2022 12:05:06 +0100 Subject: [PATCH] Update ProcessChallengeContext/ProcessSignOutContext.Nonce's documentation to emphasize that nonces should be generated using a crypto-secure RNG --- src/OpenIddict.Client/OpenIddictClientEvents.cs | 4 ++++ src/OpenIddict.Server/OpenIddictServerHandlers.Protection.cs | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/src/OpenIddict.Client/OpenIddictClientEvents.cs b/src/OpenIddict.Client/OpenIddictClientEvents.cs index a98cd386..fbe07070 100644 --- a/src/OpenIddict.Client/OpenIddictClientEvents.cs +++ b/src/OpenIddict.Client/OpenIddictClientEvents.cs @@ -792,6 +792,8 @@ public static partial class OpenIddictClientEvents /// /// Gets or sets the nonce that will be used for the challenge demand, if applicable. + /// Note: this value MUST NOT be user-defined or extracted from any request and MUST be random + /// (generated by a random number generator suitable for cryptographic operations). /// public string? Nonce { get; set; } @@ -931,6 +933,8 @@ public static partial class OpenIddictClientEvents /// /// Gets or sets the nonce that will be used for the sign-out demand, if applicable. + /// Note: this value MUST NOT be user-defined or extracted from any request and MUST be random + /// (generated by a random number generator suitable for cryptographic operations). /// public string? Nonce { get; set; } diff --git a/src/OpenIddict.Server/OpenIddictServerHandlers.Protection.cs b/src/OpenIddict.Server/OpenIddictServerHandlers.Protection.cs index 3b32fe62..c3503c8c 100644 --- a/src/OpenIddict.Server/OpenIddictServerHandlers.Protection.cs +++ b/src/OpenIddict.Server/OpenIddictServerHandlers.Protection.cs @@ -1339,7 +1339,7 @@ public static partial class OpenIddictServerHandlers do { // Note: unlike other reference tokens, user codes are meant to be used by humans, - // who may have to enter it in a web form. To ensure it remains easy enough to type + // who may have to enter it in a web form. To ensure they remain easy enough to type // even by users with non-Latin keyboards, user codes generated by OpenIddict are // only compound of 12 digits, generated using a crypto-secure random number generator. // In this case, the resulting user code is estimated to have at most ~40 bits of entropy.