[net] xsrf: sha1 -> sha256
今も元気ハツラツ太郎 (Gerrit)
今も元気ハツラツ太郎 has uploaded the change for review![]( "Open in Gerrit")
Commit message
xsrf: sha1 -> sha256
Change diff
diff --git a/xsrftoken/xsrf.go b/xsrftoken/xsrf.go
index e808e6d..dc28254 100644
--- a/xsrftoken/xsrf.go
+++ b/xsrftoken/xsrf.go
@@ -7,7 +7,7 @@
import (
"crypto/hmac"
- "crypto/sha1"
+ "crypto/sha256"
"crypto/subtle"
"encoding/base64"
"fmt"
@@ -42,7 +42,7 @@
// Round time up and convert to milliseconds.
milliTime := (now.UnixNano() + 1e6 - 1) / 1e6
- h := hmac.New(sha1.New, []byte(key))
+ h := hmac.New(sha256.New, []byte(key))
fmt.Fprintf(h, "%s:%s:%d", clean(userID), clean(actionID), milliTime)
// Get the no padding base64 string.
Change information
- M xsrftoken/xsrf.go
Related details
Code-Review
No-Unresolved-Comments
Review-Enforcement
TryBots-Pass
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Gopher Robot (Gerrit)
Message from Gopher Robot![]( "Open in Gerrit")
Congratulations on opening your first change. Thank you for your contribution!
Next steps:
A maintainer will review your change and provide feedback. See
https://go.dev/doc/contribute#review for more info and tips to get your
patch through code review.
Most changes in the Go project go through a few rounds of revision. This can be
surprising to people new to the project. The careful, iterative review process
is our way of helping mentor contributors and ensuring that their contributions
have a lasting impact.
During May-July and Nov-Jan the Go project is in a code freeze, during which
little code gets reviewed or merged. If a reviewer responds with a comment like
R=go1.11 or adds a tag like "wait-release", it means that this CL will be
reviewed as part of the next development cycle. See https://go.dev/s/release
for more details.
Related details
Code-Review
No-Unresolved-Comments
Review-Enforcement
TryBots-Pass
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
今も元気ハツラツ太郎 (Gerrit)
今も元気ハツラツ太郎 uploaded new patchset![]( "Open in Gerrit")
Related details
Code-Review
No-Unresolved-Comments
Review-Enforcement
TryBots-Pass
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
今も元気ハツラツ太郎 (Gerrit)
今も元気ハツラツ太郎 uploaded new patchset![]( "Open in Gerrit")
Related details
- Damien Neil
- Ian Lance Taylor
Code-Review
No-Unresolved-Comments
Review-Enforcement
TryBots-Pass
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Sean Liao (Gerrit)
Sean Liao added 1 comment![]( "Open in Gerrit")
This is potentially disruptive during a gradual rollout as you may have old tokens that can't be validated by the new version, or the inverse.
I think we should instead aim to point users to the new https://pkg.go.dev/net/http#CrossOriginProtection
Related details
- Damien Neil
- Ian Lance Taylor
- 今も元気ハツラツ太郎
Code-Review
No-Unresolved-Comments
Review-Enforcement
TryBots-Pass
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |