Jeremy Evans 458d06d579 Ensure OIDC nonce does not repeat ...

Currently, the nonce is randomly generated with 32 bytes, so
statistically it should not run result in a duplicate nonce until
256**16 nonces have been generated. While that's probably fine,
it's better to use an approach where nonces are not more likely to
be duplicates over time.

This changes nonce generation to use a time-based component.
The nonce is now nanosecond specific, and still has 13 bytes of
randomness, which should be sufficiently random while still
providing the quality that the chance of a duplicate nonce does
not increase over time.

2025-07-09 00:42:54 +09:00

7.0 KiB

Raw Permalink Blame History

View Raw