Skip to content

fix: replace insecure Math.random() nonces with crypto APIs#1517

Open
clicheman wants to merge 1 commit into
base:masterfrom
clicheman:fix/replace-math-random-nonces-with-crypto
Open

fix: replace insecure Math.random() nonces with crypto APIs#1517
clicheman wants to merge 1 commit into
base:masterfrom
clicheman:fix/replace-math-random-nonces-with-crypto

Conversation

@clicheman
Copy link
Copy Markdown

What changed? Why?

Replaced all Math.random() usages for nonce generation with cryptographically secure alternatives across three documentation files.

Math.random() is not cryptographically secure and produces predictable output. Using it for SIWE nonces or security-sensitive values exposes developers who copy these examples to replay attacks.

Changes

File Before After
wagmi/setup.mdx Math.random().toString(36).substring(2, 15) crypto.randomUUID()
sign-in-with-base-button.mdx Math.random().toString(36).substring(7) crypto.randomUUID()
sign-and-verify-typed-data.mdx Math.floor(Math.random() * 1000000) crypto.randomInt(1_000_000) + added import crypto

Notes to reviewers

  • crypto.randomUUID() is available in all modern browsers and Node.js 19+ (Web Crypto API)
  • crypto.randomInt() is used in the server-side example (Node.js crypto module) since the nonce there is a numeric value
  • Consistent with the existing authenticate-users guide which already uses crypto.randomUUID()

Closes #1477

Replace all Math.random() usages for nonce generation with
cryptographically secure alternatives:

- wagmi/setup.mdx: use crypto.randomUUID()
- sign-in-with-base-button.mdx: use crypto.randomUUID()
- sign-and-verify-typed-data.mdx: use crypto.randomInt() with
  import crypto

Math.random() is not cryptographically secure and should not be
used for SIWE nonces or security-sensitive values.

Closes base#1477
@cb-heimdall
Copy link
Copy Markdown
Collaborator

🟡 Heimdall Review Status

Requirement Status More Info
Reviews 🟡 0/2
Denominator calculation
Show calculation
1 if user is bot 0
1 if user is external 0
2 if repo is sensitive 0
From .codeflow.yml 1
Additional review requirements
Show calculation
Max 0
0
From CODEOWNERS 0
Global minimum 0
Max 1
1
1 if commit is unverified 1
Sum 2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] Math.random() used for SIWE nonce in Wagmi setup example — not cryptographically secure

2 participants