You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The uuidv4 generator in util used `Math.random()`, which does not provide strong uniqueness guarantees
(https://www.bocoup.com/blog/random-numbers).
The places where the uuidv4 generator were used didn't require strong
uniqueness guarantees (nothing security related), but I think it's good
to move away from this from util in case we try to use it in the future.
A better built-in alternative is `crypto.randomUUID()`, which does provide strong
uniqueness guarantees. Since this is a more modern JS built-in, it's
only [defined in secure
contexts](https://blog.mozilla.org/security/2018/01/15/secure-contexts-everywhere/).
Is this something we're concerned about? Are there any App Check users
with apps running in non-secure environments?
0 commit comments