justauth/JustAuth

Random not secure, switch to SecureRandom

Gax-c opened this issue · 0 comments

Hi, I am new to JustAuth, and when I was browsing the code I found in the file GlobalAuthUtils.java, Random is used to generate the nonce here.

    public static String generateNonce(int len) {
        String s = "0123456789QWERTYUIOPLKJHGFDSAZXCVBNMqwertyuioplkjhgfdsazxcvbnm";
        Random rng = new Random();
        StringBuilder sb = new StringBuilder();
        for (int i = 0; i < len; i++) {
            int index = rng.nextInt(62);
            sb.append(s, index, index + 1);
        }
        return sb.toString();
    }

However, it's not secure enough, so switching to SecureRandom can be a better choice.