Skip to content

refactor(auth): use SecureRandom for random hex string generation#4285

Open
carloea2 wants to merge 2 commits intoapache:mainfrom
carloea2:fix/random
Open

refactor(auth): use SecureRandom for random hex string generation#4285
carloea2 wants to merge 2 commits intoapache:mainfrom
carloea2:fix/random

Conversation

@carloea2
Copy link
Contributor

What changes were proposed in this PR?

This PR updates random hex string generation in the Auth module to use SecureRandom instead of Random.

It also changes the hex string construction to use fixed-width integer-to-hex conversion (%08x), so each generated integer consistently contributes 8 hexadecimal characters. This keeps the generated value length stable and makes the implementation more predictable across environments.

Current Implementation:

private def getRandomHexString: String = {
val bytes = 32
val r = new Random()
val sb = new StringBuffer
while (sb.length < bytes)
sb.append(Integer.toHexString(r.nextInt()))
sb.toString.substring(0, bytes)
}

Any related issues, documentation, discussions?

Closes #4284

How was this PR tested?

Manually verified that the updated implementation:

  • returns a 32-character hexadecimal string
  • preserves the existing method behavior and output length
  • uses fixed-width 8-character hex chunks for each generated integer

Was this PR authored or co-authored using generative AI tooling?

No

@chenlica chenlica requested a review from bobbai00 March 12, 2026 15:14
Copy link
Contributor

@bobbai00 bobbai00 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Migrate from Random() to SecureRandom()

2 participants