Question

I’ve been using an OAuthBase class found HERE in my SSIS 2008 C# Script Components (.NET 3.5).

It’s been working fine, but recently I’ve ran into the problem where if I execute multiple script components in the same Data Flow Task, using the GenerateNonce method in the above OAuthBase class, I end up with the same nonce (random number).

Here’s an excerpt from the OAuthBase class that generates the nonce:

using System;
using System.Security.Cryptography;
using System.Collections.Generic;
using System.Text;
using System.Web;

namespace OAuth {
 public class OAuthBase {

    ....snip......

    protected Random random = new Random();

    public virtual string GenerateNonce() {
        // Just a simple implementation of a random number between 123400 and 9999999
        return random.Next(123400, 9999999).ToString();
    }
  }
}

In each script component I’m using this C# code to initiate the class and generate a nonce:

        OAuthBase oAuth = new OAuthBase();
        string nonce = oAuth.GenerateNonce();

From my searching around I think this is related to it not being thread safe? I’m not totally sure.

I’m only able to run .NET 3.5 in SSIS 2008, so I know some of the newer stuff introduced in .NET 4.0 I can’t use.

Any ideas on how I can either modify the OAuthBase class and/or my C# script component code?

Answer 1

If you create multiple instance of OAuthBase at the same time, it is entirely possible that the individual instance will have a Random instance with the same seed, which by default the seed is the current tick count. So this means the individual instances of Random possibly have been created with the same seed. Try making the Random instance static. But since Random is not thread safe. You would need to protect access to it.

private static readonly Random random = new Random();
private static readonly object randLock = new object();

public virtual string GenerateNonce()
{
    lock (randLock)
    {
        // Just a simple implementation of a random number between 123400 and 9999999
        return random.Next(123400, 9999999).ToString();
    }
}

// since you had protected access on random, I'm assuming sub classes want to use it
// so you'll need to provide them with access to it
protected int NextRandom(...)
{
    lock (randLock)
    {
         random.Next(...);
    }
}

But as others have suggested since you don’t have a cryptographically strong source of randomness, you may want to look at other ways to generate your value.

// RNGCryptoServiceProvider is thread safe in .NET 3.5 and above
// .NET 3.0 and below will need locking to protect access
private static readonly RNGCryptoServiceProvider random =
    new RNGCryptoServiceProvider();

public /*virtual*/ byte[] GenerateNonce(int length)
{
    // a default length could be specified instead of being parameterized
    var data = new byte[length];
    random.GetNonZeroBytes(data);
    return data;
}
// or
public /*virtual*/ string GenerateNonce(int length)
{
    var data = new byte[length];
    random.GetNonZeroBytes(data);        
    return Convert.ToBase64String(data);
}