You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This function is used to generate unique UIDs throughout the SAML library. Given that SAML deals with authentication, it seems like poor practice to not generate random UIDs in a cryptographically secure manner.
Hi @gen0cide - I'm closing this ticket off as the generateUniqueID fn has been updated in #116 to use https://github.com/auth0/id-generator internally - the implementation of that lib mimics the nodejs randomInt fn you've referenced.
node-samlp/lib/utils.js
Line 132 in cb5adc4
This function is used to generate unique UIDs throughout the SAML library. Given that SAML deals with authentication, it seems like poor practice to not generate random UIDs in a cryptographically secure manner.
Reference: https://nodejs.org/api/crypto.html#crypto_crypto_randomint_min_max_callback
Guidance: https://gist.github.com/joepie91/7105003c3b26e65efcea63f3db82dfba
The text was updated successfully, but these errors were encountered: