Change nonce and state to length 22

cweibel · cweibel · commit 8120b8b4593c · 2025-10-09T14:20:38.000-04:00
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthProviderConfigurator.java b/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthProviderConfigurator.java
@@ -108,7 +108,7 @@ public String getIdpAuthenticationUrl(
         }
 
         if (OIDCIdentityProviderDefinition.class.equals(definition.getParameterizedClass())) {
-            var nonceGenerator = new RandomValueStringGenerator(12);
+            var nonceGenerator = new RandomValueStringGenerator(22);
             uriBuilder.queryParam("nonce", nonceGenerator.generate());
 
             Map<String, String> additionalParameters = ofNullable(((OIDCIdentityProviderDefinition) definition).getAdditionalAuthzParameters()).orElse(emptyMap());
@@ -123,7 +123,7 @@ protected static boolean isPkceNeeded(AbstractExternalOAuthIdentityProviderDefin
     }
 
     private String generateStateParam() {
-        return uaaRandomStringUtil.getSecureRandom(10);
+        return uaaRandomStringUtil.getSecureRandom(22);
     }
 
     private String generateCodeVerifier() {

Original file line number	Diff line number	Diff line change
`@@ -108,7 +108,7 @@ public String getIdpAuthenticationUrl(`
`108`	`108`	`}`
`109`	`109`
`110`	`110`	`if (OIDCIdentityProviderDefinition.class.equals(definition.getParameterizedClass())) {`
`111`		`- var nonceGenerator = new RandomValueStringGenerator(12);`
	`111`	`+ var nonceGenerator = new RandomValueStringGenerator(22);`
`112`	`112`	`uriBuilder.queryParam("nonce", nonceGenerator.generate());`
`113`	`113`
`114`	`114`	`Map<String, String> additionalParameters = ofNullable(((OIDCIdentityProviderDefinition) definition).getAdditionalAuthzParameters()).orElse(emptyMap());`
`@@ -123,7 +123,7 @@ protected static boolean isPkceNeeded(AbstractExternalOAuthIdentityProviderDefin`
`123`	`123`	`}`
`124`	`124`
`125`	`125`	`private String generateStateParam() {`
`126`		`- return uaaRandomStringUtil.getSecureRandom(10);`
	`126`	`+ return uaaRandomStringUtil.getSecureRandom(22);`
`127`	`127`	`}`
`128`	`128`
`129`	`129`	`private String generateCodeVerifier() {`