Switched to Wt::WRandom to generate secrets

src/auth/AuthService.cpp

@@ -21,10 +21,9 @@
 
 #include "AuthService.hpp"
 
-#include <iomanip>
 #include <Wt/Auth/HashFunction.h>
 #include <Wt/Auth/PasswordStrengthValidator.h>
-#include <Wt/Utils.h>
+#include <Wt/WRandom.h>
 
 #include "database/Session.hpp"
 #include "utils/Utils.hpp"
@@ -73,14 +72,7 @@ AuthService::checkUserPassword(Database::Session& session, const boost::asio::ip
 Database::User::PasswordHash
 AuthService::hashPassword(const std::string& password) const
 {
-	std::array<std::uint8_t, 16> buffer;
+	const std::string salt {Wt::WRandom::generateId(32)};
-	fillRandom(buffer);
-
-	std::ostringstream oss;
-	for (std::uint8_t b : buffer)
-		oss << std::hex << std::setfill('0') << std::setw(2) << static_cast<int>(b);
-
-	const std::string salt {Wt::Utils::base64Encode(oss.str(), false)};
 
 	const Wt::Auth::BCryptHashFunction hashFunc {6};
 	return {salt, hashFunc.compute(password, salt)};

src/ui/Auth.cpp

@@ -25,11 +25,11 @@
 #include <Wt/WLineEdit.h>
 #include <Wt/WCheckBox.h>
 #include <Wt/WPushButton.h>
+#include <Wt/WRandom.h>
 
 #include "auth/AuthService.hpp"
 #include "main/Service.hpp"
 #include "utils/Logger.hpp"
-#include "utils/Utils.hpp"
 
 #include "common/Validators.hpp"
 #include "LmsApplication.hpp"
@@ -38,27 +38,12 @@ namespace UserInterface {
 
 static const std::string authCookieName {"LmsAuth"};
 
-static
-std::string
-createSecret()
-{
-	std::array<std::uint8_t, 32> buffer;
-	fillRandom(buffer);
-
-	std::ostringstream oss;
-	for (std::uint8_t b : buffer)
-		oss << std::hex << std::setfill('0') << std::setw(2) << static_cast<int>(b);
-
-	return oss.str();
-}
-
-
 static
 void
 createAuthToken(Database::IdType userId)
 {
 
-	const std::string secret {createSecret()};
+	const std::string secret {Wt::WRandom::generateId(48)};
 	const Wt::WDateTime now {Wt::WDateTime::currentDateTime()};
 	Wt::WDateTime expiry;
 

src/utils/Utils.hpp

@@ -114,20 +114,6 @@ shuffleContainer(Container& container)
 	std::shuffle(std::begin(container), std::end(container), randGenerator);
 }
 
-template <typename Container>
-void
-fillRandom(Container& container)
-{
-	using value_type = typename Container::value_type;
-	static_assert(std::is_integral<value_type>::value, "Integral required");
-
-	std::random_device rd;
-	std::mt19937_64 randGenerator {rd()};
-	std::uniform_int_distribution<> dist {std::numeric_limits<value_type>::min(), std::numeric_limits<value_type>::max()};
-
-	std::for_each(std::begin(container), std::end(container), [&](auto& elem) { elem = dist(randGenerator); });
-}
-
 template <typename Container>
 typename Container::iterator
 pickRandom(Container& container)