summaryrefslogtreecommitdiff
path: root/eaaf_core_utils/src
diff options
context:
space:
mode:
authorThomas Lenz <thomas.lenz@egiz.gv.at>2020-12-10 15:01:14 +0100
committerThomas Lenz <thomas.lenz@egiz.gv.at>2020-12-10 15:01:14 +0100
commit6cebc7aa1aecb1bc8f87443887a90fe851893954 (patch)
tree90f9b8b0187a4bb4d033ccd57cc15e72b27791ae /eaaf_core_utils/src
parenta126c249b8ed83dce4386331a49d04a42b53e448 (diff)
parent360df2054cdc5a8bc194f7701b2bfa5a9c39dd0d (diff)
downloadEAAF-Components-6cebc7aa1aecb1bc8f87443887a90fe851893954.tar.gz
EAAF-Components-6cebc7aa1aecb1bc8f87443887a90fe851893954.tar.bz2
EAAF-Components-6cebc7aa1aecb1bc8f87443887a90fe851893954.zip
Merge branch 'feature/someSmallUpdates' into 'nightlyBuild'
Feature/some small updates See merge request egiz/eaaf_components!6
Diffstat (limited to 'eaaf_core_utils/src')
-rw-r--r--eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/utils/SecurePendingRequestIdGenerationStrategy.java5
1 files changed, 3 insertions, 2 deletions
diff --git a/eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/utils/SecurePendingRequestIdGenerationStrategy.java b/eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/utils/SecurePendingRequestIdGenerationStrategy.java
index 8ec5f3a8..cfb4ed88 100644
--- a/eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/utils/SecurePendingRequestIdGenerationStrategy.java
+++ b/eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/utils/SecurePendingRequestIdGenerationStrategy.java
@@ -2,8 +2,8 @@ package at.gv.egiz.eaaf.core.impl.utils;
import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException;
+import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
-import java.util.Arrays;
import java.util.Base64;
import javax.annotation.PostConstruct;
@@ -109,7 +109,8 @@ public class SecurePendingRequestIdGenerationStrategy
log.trace("Checking HMAC from externalPendingReqId ... ");
final byte[] tokenDigest = Base64.getDecoder().decode(tokenElements[2]);
final byte[] refDigist = calculateHmac(buildInternalToken(internalPendingReqId, timeStamp));
- if (!Arrays.equals(tokenDigest, refDigist)) {
+
+ if (!MessageDigest.isEqual(refDigist,tokenDigest)) {
log.warn("Digest of Token does NOT match");
log.debug("Token: {} | Ref: {}", tokenDigest, refDigist);
throw new PendingReqIdValidationException(null, "internal.pendingreqid.04");