From 82a36497ffbc2fc2ee6f9b8bb0d811f267708897 Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Mon, 2 Feb 2026 09:59:54 +0000 Subject: [PATCH] Bug 38365: Increase CSP nonce entropy to 128+ bits MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit OWASP recommends CSP nonces have at least 128 bits of entropy. The previous 10-character alphanumeric nonce provided only ~59 bits (log2(62^10) ≈ 59.5). Increase to 22 characters which provides ~130 bits of entropy (log2(62^22) ≈ 130.5), exceeding the OWASP recommendation. --- Koha/ContentSecurityPolicy.pm | 2 +- t/Koha/ContentSecurityPolicy.t | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Koha/ContentSecurityPolicy.pm b/Koha/ContentSecurityPolicy.pm index b88ea6200cc..79c8bc99ca1 100644 --- a/Koha/ContentSecurityPolicy.pm +++ b/Koha/ContentSecurityPolicy.pm @@ -197,7 +197,7 @@ sub nonce { } unless ( $self->{nonce} ) { - $nonce = Koha::Token->new()->generate( { pattern => '\w{10}' } ); + $nonce = Koha::Token->new()->generate( { pattern => '\w{22}' } ); $self->{nonce} = $nonce; } diff --git a/t/Koha/ContentSecurityPolicy.t b/t/Koha/ContentSecurityPolicy.t index b8d01737de1..ba4f9714ef0 100755 --- a/t/Koha/ContentSecurityPolicy.t +++ b/t/Koha/ContentSecurityPolicy.t @@ -168,7 +168,7 @@ subtest 'nonce tests' => sub { $csp = Koha::ContentSecurityPolicy->new(); my $nonce = $csp->nonce; - like( $nonce, qr/\w{10}/, 'nonce is a random string of 10 characters' ); + like( $nonce, qr/\w{22}/, 'nonce is a random string of 22 characters (128+ bits entropy)' ); is( $nonce, $csp->nonce, 're-calling nonce() returns the same randomly generated cached value' ); $cache->set_in_cache( 'CSP-NONCE', 'cached value' ); -- 2.52.0