Replace uuidv4 generator with crypto.randomUUID()
#8600
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The uuidv4 generator in util used `Math.random()`, which does not provide strong uniqueness guarantees (https://www.bocoup.com/blog/random-numbers). The places where the uuidv4 generator were used didn't require strong uniqueness guarantees (nothing security related), but I think it's good to move away from this from util in case we try to use it in the future. A better built-in alternative is `crypto.randomUUID()`, which does provide strong uniqueness guarantees. Since this is a more modern JS built-in, it's only [defined in secure contexts](https://blog.mozilla.org/security/2018/01/15/secure-contexts-everywhere/). Is this something we're concerned about? Are there any App Check users with apps running in non-secure environments?
dlarocque
requested review from
hsubox76,
a team,
maneesht and
aashishpatil-g
as code owners
🦋 Changeset detectedLatest commit: 1e712d0 The changes in this PR will be included in the next version bump. This PR includes changesets to release 30 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Size Report 1Affected Products
Test Logs |
Changeset File Check
|
Size Analysis Report 1Affected Products
Test Logs |
What's the effect of this, if you deploy an app with App Check to a site and call it with HTTP, do you get an error? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The uuidv4 generator in util uses
Math.random(), which does not provide strong uniqueness guarantees (https://www.bocoup.com/blog/random-numbers).The places where the uuidv4 generator are used don't require strong uniqueness guarantees (nothing security related), but I think it's good to move away from this from util in case we try to use it in the future.
A better built-in alternative is
crypto.randomUUID(), which does provide strong uniqueness guarantees. I believe the reason this wasn't used originally was because it wasn't supported in Node <15. Since this is a more modern JS built-in, it's only defined in secure contexts. Is this something we're concerned about? Are there any App Check users with apps running in non-secure environments?Fixes #6462
Also closes b/283984828