[
https://issues.apache.org/jira/browse/WICKET-5327?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13835042#comment-13835042
]
Sven Meier commented on WICKET-5327:
------------------------------------
And now SecuritySettings writes a warning to stderr for the default crypt key.
> CryptoMapper: insecure default encryption provider
> --------------------------------------------------
>
> Key: WICKET-5327
> URL: https://issues.apache.org/jira/browse/WICKET-5327
> Project: Wicket
> Issue Type: Improvement
> Affects Versions: 6.10.0
> Reporter: Walter B. Rasmann
> Assignee: Sven Meier
> Labels: security
> Fix For: 6.11.0, 7.0.0
>
>
> There is an unexpected and insecure default setting for the encryption
> provider.
> When CryptoMapper is enabled using
> setRootRequestMapper(new CryptoMapper(getRootRequestMapper(), this));
> or
>
> CompoundRequestMapper root = new CompoundRequestMapper();
> root.add(new CryptoMapper(getRootRequestMapper(), this));
> setRootRequestMapper(root);
> Wicket uses "new
> CachingSunJceCryptFactory(ISecuritySettings.DEFAULT_ENCRYPTION_KEY)" as the
> CryptFactory, with ISecuritySettings.DEFAULT_ENCRYPTION_KEY being
> "WiCkEt-FRAMEwork". This generates always the same encrypted strings for each
> of the URLs and is possibly not a secure way to encrypt URLs even if the
> encryption key is unknown.
--
This message was sent by Atlassian JIRA
(v6.1#6144)
