Session ID must use cryptographically strong random number generator

santhoshdaivajna · Oct 6, 2014 · 6af4f9c · 6af4f9c
1 parent 5fb5e73
commit 6af4f9c
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/hazelcast-wm/src/main/java/com/hazelcast/web/WebFilter.java b/hazelcast-wm/src/main/java/com/hazelcast/web/WebFilter.java
@@ -25,7 +25,6 @@
 import com.hazelcast.core.MapEvent;
 import com.hazelcast.logging.ILogger;
 import com.hazelcast.logging.Logger;
-import com.hazelcast.util.UuidUtil;
 
 import javax.servlet.Filter;
 import javax.servlet.FilterChain;
@@ -50,6 +49,7 @@
 import java.util.Map.Entry;
 import java.util.Properties;
 import java.util.Set;
+import java.util.UUID;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
 import java.util.logging.Level;
@@ -146,7 +146,7 @@ void destroyOriginalSession(HttpSession originalSession) {
     }
 
     private static String generateSessionId() {
-        final String id = UuidUtil.buildRandomUuidString();
+        final String id = UUID.randomUUID().toString();
         final StringBuilder sb = new StringBuilder("HZ");
         final char[] chars = id.toCharArray();
         for (final char c : chars) {