Currently we expose ResourceId values in various places:
- Via the lockInfo command
- Via logging
- Via error messages
If an attacker were to know the value for a given input then they could derive the random secret key we use in order to generate ResourceIds and perform the same attack as SERVER-114838.
We should limit it such that it is only ever exposed in high permission settings such as the first two while limiting the last one.
- is related to
-
SERVER-114838 Lock Manager is susceptible to an adversarial DDOS attack
-
- Closed
-