Skip to content

[SECURITY] Non-crypto random used for token generation fallback #136

@Livezt

Description

@Livezt

Security Bug: Non-Crypto Random in Token Fallback

File: src/web/client/GatewayBrowserClient.ts lines 230-237

Issue: Math.random() used as fallback for token generation. Predictable tokens.

Recommended Fix: Use crypto.getRandomValues() or crypto.randomUUID():

const token = crypto.getRandomValues(new Uint8Array(32));

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions