|
|
@ -285,24 +285,22 @@ public class DefaultSystemDataLoaderService implements SystemDataLoaderService { |
|
|
@Override |
|
|
@Override |
|
|
public void updateJwtSettings() { |
|
|
public void updateJwtSettings() { |
|
|
JwtSettings jwtSettings = jwtSettingsService.getJwtSettings(); |
|
|
JwtSettings jwtSettings = jwtSettingsService.getJwtSettings(); |
|
|
|
|
|
|
|
|
boolean invalidSignKey = false; |
|
|
boolean invalidSignKey = false; |
|
|
|
|
|
String warningMessage = null; |
|
|
|
|
|
|
|
|
if (isSigningKeyDefault(jwtSettings)) { |
|
|
if (isSigningKeyDefault(jwtSettings)) { |
|
|
log.warn("WARNING: The platform is configured to use default JWT Signing Key. " + |
|
|
warningMessage = "The platform is using the default JWT Signing Key, which is a security risk."; |
|
|
"Added new temporary JWT Signing Key. " + |
|
|
|
|
|
"This is a security issue that needs to be resolved. Please change the JWT Signing Key using the Web UI. " + |
|
|
|
|
|
"Navigate to \"System settings -> Security settings\" while logged in as a System Administrator."); |
|
|
|
|
|
invalidSignKey = true; |
|
|
invalidSignKey = true; |
|
|
} else if (!validateTokenSigningKeyLength(jwtSettings)) { |
|
|
} else if (!validateTokenSigningKeyLength(jwtSettings)) { |
|
|
log.warn("WARNING: The platform is configured to use JWT Signing Key with length less then 512 bits of data. " + |
|
|
warningMessage = "The JWT Signing Key is shorter than 512 bits, which is a security risk."; |
|
|
"Added new temporary JWT Signing Key. " + |
|
|
|
|
|
"This is a security issue that needs to be resolved. Please change the JWT Signing Key using the Web UI. " + |
|
|
|
|
|
"Navigate to \"System settings -> Security settings\" while logged in as a System Administrator."); |
|
|
|
|
|
invalidSignKey = true; |
|
|
invalidSignKey = true; |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
if (invalidSignKey) { |
|
|
if (invalidSignKey) { |
|
|
|
|
|
log.warn("WARNING: {}. A new JWT Signing Key has been added automatically. " + |
|
|
|
|
|
"You can change the JWT Signing Key using the Web UI: " + |
|
|
|
|
|
"Navigate to \"System settings -> Security settings\" while logged in as a System Administrator.", warningMessage); |
|
|
|
|
|
|
|
|
jwtSettings.setTokenSigningKey(Base64.getEncoder().encodeToString( |
|
|
jwtSettings.setTokenSigningKey(Base64.getEncoder().encodeToString( |
|
|
RandomStringUtils.randomAlphanumeric(64).getBytes(StandardCharsets.UTF_8))); |
|
|
RandomStringUtils.randomAlphanumeric(64).getBytes(StandardCharsets.UTF_8))); |
|
|
jwtSettingsService.saveJwtSettings(jwtSettings); |
|
|
jwtSettingsService.saveJwtSettings(jwtSettings); |
|
|
|