Use random bytes when generating nonce

Shopify · Feb 9, 2021 · 24affb2 · 24affb2
1 parent 977c79f
commit 24affb2
Showing 1 changed file with 10 additions and 7 deletions.
diff --git a/src/utils/nonce.ts b/src/utils/nonce.ts
@@ -1,11 +1,14 @@
+import crypto from 'crypto';
+
 export default function nonce(): string {
   const length = 15;
-  let nonce = '';
+  const bytes = crypto.randomBytes(length);
 
-  for (let i = 0; i <= 3; i++) {
-    nonce += Math.round(Number(new Date()) * Math.random());
-  }
+  const nonce = bytes
+    .map((byte) => {
+      return byte % 10;
+    })
+    .join("");
 
-  const str = nonce.substr(nonce.length - length);
-  return str;
-}
+  return nonce;
+}