better sessionId generator fix jooby-project#339

jknack · jknack · commit 025e2cdf1b21 · 2016-04-03T18:34:02.000-03:00
diff --git a/jooby/src/main/java/org/jooby/Session.java b/jooby/src/main/java/org/jooby/Session.java
@@ -20,12 +20,14 @@
 
 import static java.util.Objects.requireNonNull;
 
+import java.security.SecureRandom;
 import java.util.Map;
 import java.util.Optional;
-import java.util.UUID;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
 
+import com.google.common.io.BaseEncoding;
+
 /**
  * <p>
  * Sessions are created on demand via: {@link Request#session()}.
@@ -185,6 +187,9 @@ public Cookie.Definition cookie() {
    */
   interface Store {
 
+    /** Single secure random instance. */
+    SecureRandom rnd = new SecureRandom();
+
     /**
      * Get a session by ID (if any).
      *
@@ -210,14 +215,14 @@ interface Store {
     void delete(String id);
 
     /**
-     * Generate a session ID, default algorithm use an {@link UUID}.
+     * Generate a session ID.
      *
      * @return A unique session ID.
      */
     default String generateID() {
-      UUID uuid = UUID.randomUUID();
-      return Long.toString(Math.abs(uuid.getMostSignificantBits()), 36)
-          + Long.toString(Math.abs(uuid.getLeastSignificantBits()), 36);
+      byte[] bytes = new byte[30];
+      rnd.nextBytes(bytes);
+      return BaseEncoding.base64Url().encode(bytes);
     }
   }
 
