Non-cryptographically secure PRNG use in the OWIN OAuth2 server docs

[zerkms]

http://www.asp.net/aspnet/overview/owin-and-katana/owin-oauth-20-authorization-server

Here the GUID is used to generate security tokens.

Instead it should be a cryptographically strong PRNG used, eg RNGCryptoServiceProvider.

[danroth27]

@blowdart

[blowdart]

1. This is not an ASP.NET Core issue.
2. GUIDs are (at least on Windows) generated with input from a secure PRNG.

Combining the fact that this is ASP.NET 4.5 is only one Windows (point 1) and point 2, means this is a non-issue.

[zerkms]

https://blogs.msdn.microsoft.com/oldnewthing/20120523-00/?p=7553 and https://blogs.msdn.microsoft.com/ericlippert/2012/05/07/guid-guide-part-three/

But yep, this is the wrong repository.