Direkt zum Hauptbereich

Create a Bearer token in Scala

Bearer tokens are a standard which is used in OAuth 2.0. Although there have been discussions if the security mechanisms are significantly weaker than the use of using signatures as many implementations of OAuth 1.0 did (see http://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-00), bearer tokens are part of the OAuth 2.0 specification and therefore widely adopted in nearly all implementations.

The syntax of Bearer tokens is specified in RFC6750 (http://http://tools.ietf.org/html/rfc6750)

This is a lean utils object to create specification compliant Bearers in Scala using the java.security.SecureRandom implementation as a randomizer.

The standard generate function returns a token of 32 byte length. A second polymorphic functions allows for the generation of a token of individual size.


import scala.util._
import java.security.SecureRandom

/*
 * Generates a Bearer Token with the length of 32 characters according to the
 * specification RFC6750 (http://http://tools.ietf.org/html/rfc6750)
 */
object BearerTokenGenerator {
  
  val TOKEN_LENGTH = 32
  val TOKEN_CHARS = 
     "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-._"
  val secureRandom = new SecureRandom()
    
  def generateToken:String =  
    generateToken(TOKEN_LENGTH)   
  
  def generateToken(tokenLength: Int): String =
    if(tokenLength == 0) "" else TOKEN_CHARS(secureRandom.nextInt(TOKEN_CHARS.length())) + 
     generateToken(tokenLength - 1)
  
}

Kommentare

Beliebte Posts aus diesem Blog

Device-Weiche in PHP

Anforderungen für Device-Weichen Je mehr Anforderungen an die Unterstützung von unterschiedlichen Devices kommen, desto öfter steht man vor der Frage, wie die verschiedenen Ausgabegeräte zwecks unterschiedliche Behandlung auf einer Seite unterschieden werden können, um dann z.B. jeweils eine Weiterleitung auf unterschiedliche Zielseiten vorzunehmen welche das entsprechende Device unterstützen, also eine sogenannte Device-Weiche oder Browser-Weiche. Klassische Use Cases sind hier: Je nach Device die "klassische" Website oder die mobile Site anzeigen Eine Landing Page erstellen, welche unterschiedliche mobile Devices zu unterschiedlichen Zielseiten (z.B. Subdomains) verzweigt Eine Redirect-Verteilerseite, welche mobile Devices in die verschiedenen Stores für einen mobile App Download weiterleitet Das letztgenannte Beispiel möchte ich hier einmal exemplarisch demonstrieren. Man stelle sich folgendes Szenario vor: Demo-Szenario Im Rahmen einer Web-Anwendung ...

Add an existing Grails project to Bitbucket using Git

I just started using Bitbucket as a new service to host masters of my source code repositories using Git. If you develop with Grails (like I also do more often) and ever asked yourself how to create a Git repository out of an existing project, here is the solution. Prerequisits Of course you need to have Git installt locally on your machine. If you haven't here are instructions on how to do it (if your a Mac user, I find this Mac OS X installer very useful). Of course you also need an account for bitbucket.org . It's free and easy to set up. In addition to your account you need to create an empty repository. Follow the guidance on the Bitbucket site, it's quite easy. Prepare your grails project As you do not want to store all your files in the repository, you need to create a so called .gitignore file. To do so, you can use a grails command: > grails integrate-with --git Afterwards, the .gitignore file has been created. If you are using the Grovy & Gr...

Creating load tests with Gatling instead of JMeter

I just came around a tool called Gatling (http://gatling-tool.org/) to create load tests for web applications. I used to use JMeter for a long time, but JMeter has weaknesses that Gatling doesn‘t have. JMeter uses a synchronous request approach. That means for every request JMeter generates, an internal thread is raised and therefore blocked until a response is being received or a timeout happens. This results in resource blocking on the load injector. The maximum number of threads is limited within a JVM - dependent on the underlying infrastructure -  and even if you are able to run a lot of parallel threads this will result in a high CPU and memory utilization. Although performance tweaking and scaling out to distributed testing might help in such a case, it makes testing more complex and error-prone. This behavior can result in distorted metrics. Think about a typical breakpoint load test. You want to determine, which is the maximum number of requests per second your tested ...