Data and secrets
Use secure randomness
Generate session identifiers, reset tokens, nonces, and keys with a cryptographically secure system source instead of predictable application randomness.
8 minute lesson
Security tokens must be difficult to guess. A timestamp, counter, UUID variant with weak randomness, or Math.random() is not enough.
Use the platform cryptographic random API or a maintained library. Request enough bytes, encode them safely, and keep the raw token out of logs. Randomness is a dependency you should not reimplement.
const token = crypto.randomUUID()A reset link uses the user ID plus the current timestamp. An attacker who knows the email can predict nearby values and take over the account.
A long token is not strong when its source is predictable. Use the platform cryptographic generator and avoid inventing a custom mixing step.
Locate the generator for a reset token and record the platform API and byte length it uses. Generate many tokens to check format and uniqueness, then freeze time in a test and prove the values remain unpredictable.
Lesson completed