From 040838e05f578dfe104f77e338642ee45343fe8c Mon Sep 17 00:00:00 2001 From: Peter Palaga Date: Tue, 8 Sep 2026 08:27:07 +0200 Subject: [PATCH] Fixup #3423 Use a properly random source to generate digest client nonces Avoid static initialization of Random/SecureRandom to allow build time class initialization with GraalVM native image --- .../http/auth/DigestAuthSupplier.java | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/auth/DigestAuthSupplier.java b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/auth/DigestAuthSupplier.java index 6ab3931f90d..c7fd15c45fe 100644 --- a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/auth/DigestAuthSupplier.java +++ b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/auth/DigestAuthSupplier.java @@ -37,7 +37,8 @@ * */ public class DigestAuthSupplier implements HttpAuthSupplier { - private static final SecureRandom CNONCE_GENERATOR = new SecureRandom(); + private static volatile SecureRandom cnonceGenerator; + private static final Object CNONCE_GENERATOR_LOCK = new Object(); Map authInfo = new ConcurrentHashMap<>(); @@ -117,7 +118,20 @@ private static String getAuthURI(URI currentURI) { */ public String createCnonce() { byte[] bytes = new byte[16]; - CNONCE_GENERATOR.nextBytes(bytes); + + SecureRandom cg; + // CHECKSTYLE:OFF + // May the Gods of Code Style forgive us these three inner assignments + if ((cg = cnonceGenerator) == null) { + synchronized (CNONCE_GENERATOR_LOCK) { + if ((cg = cnonceGenerator) == null) { + cg = cnonceGenerator = new SecureRandom(); + } + } + } + // CHECKSTYLE:ON + + cg.nextBytes(bytes); return StringUtils.toHexString(bytes); }