QHelp previews:

Predictable token

GUIDs (often called UUIDs) are widely used in modern web applications. One common use for UUIDs is the generation of one-time-use tokens. These can used for password reset, and e-mail confirmation routines, for example.

There are five versions of UUIDs defined in RFC 4122. Out of the five, four are generated in a predictable manner. This means it is possible for someone to predict future UUIDs based on a sample generated by the target application.

Version four is the only UUID version expected to be randomly generated. Therefore, for situations where predictable tokens are not desired (e.g. password reset tokens), all other versions should be avoided.

Recommendation

When using GUIDs/UUIDs for generating tokens that should not be predictable, use version four.

Example

This example shows a UUID v1 being used for a password reset routine.

var uuid = require('uuid');

module.exports = function (app) {

    app.use('/login', function (req, res) {

        var username = req.body.username;
        var password = req.body.password;

        if (!username) {
            res.status(400);
            return;
        }

        if (!password) {
            res.status(400);
            return;
        }

        var newToken = {
            userId: user._id,
            token: uuid.v1(),
            created: new Date(),
        };

        res.status(200).json({
            token: newToken.token
        });
    });
};

References

• UUID RFC.
• Daniel Thatcher In GUID We Trust article.
• UUID exploitation tool.
• Common Weakness Enumeration: CWE-340.

Predictable token

GUIDs (often called UUIDs) are widely used in modern web applications. One common use for UUIDs is the generation of one-time-use tokens. These can used for password reset, and e-mail confirmation routines, for example.

There are five versions of UUIDs defined in RFC 4122. Out of the five, four are generated in a predictable manner. This means it is possible for someone to predict future UUIDs based on a sample generated by the target application.

Version four is the only UUID version expected to be randomly generated. Therefore, for situations where predictable tokens are not desired (e.g. password reset tokens), all other versions should be avoided.

Recommendation

When using GUIDs/UUIDs for generating tokens that should not be predictable, use version four.

Example

This example shows a UUID v1 being used for a password reset routine.

import uuid


class User:
    def __init__(self):
        self.token = None

    def resetPassword(self):
        self.token = uuid.uuid1().hex


user = User()
user.resetPassword()

References

• UUID RFC.
• Daniel Thatcher In GUID We Trust article.
• UUID exploitation tool.
• Common Weakness Enumeration: CWE-340.

The QHelp check is failing. You can see the error in the comment above.

Have you checked out the SensitiveNode class in JS? I think that could be useful for this query.

@bananabr Are you planning on applying for a GitHub Security Lab bounty for this PR?
I wasn't able to find a bounty issue for this PR.

@bananabr Are you planning on applying for a GitHub Security Lab bounty for this PR? I wasn't able to find a bounty issue for this PR.

Not at this time @tausbn.