Browse Source

fix(googlereader): use HMAC-SHA256 instead of HMAC-SHA1 for auth tokens

Frédéric Guillot 2 weeks ago
parent
commit
6ea078c1cb
1 changed files with 2 additions and 2 deletions
  1. 2 2
      internal/googlereader/middleware.go

+ 2 - 2
internal/googlereader/middleware.go

@@ -6,7 +6,7 @@ package googlereader // import "miniflux.app/v2/internal/googlereader"
 import (
 	"context"
 	"crypto/hmac"
-	"crypto/sha1"
+	"crypto/sha256"
 	"encoding/hex"
 	"log/slog"
 	"net/http"
@@ -176,7 +176,7 @@ func (m *authMiddleware) validateApiKey(next http.Handler) http.Handler {
 }
 
 func getAuthToken(username, password string) string {
-	token := hex.EncodeToString(hmac.New(sha1.New, []byte(username+password)).Sum(nil))
+	token := hex.EncodeToString(hmac.New(sha256.New, []byte(username+password)).Sum(nil))
 	token = username + "/" + token
 	return token
 }