Use random bytes when generating nonce

CHANGELOG.md

@@ -9,6 +9,7 @@ and adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 ### Added
 - Webhooks types are now exported outside the library [#91](https://github.com/shopify/shopify-node-api/pull/91)
 ### Fixed
+- Use cryptographically random bytes to generate nonce [#98](https://github.com/Shopify/shopify-node-api/pull/98)
 
 ## [0.3.1] - 2021-02-03
 ### Fixed

src/utils/nonce.ts

@@ -1,11 +1,14 @@
+import crypto from 'crypto';
+
 export default function nonce(): string {
   const length = 15;
-  let nonce = '';
+  const bytes = crypto.randomBytes(length);
 
-  for (let i = 0; i <= 3; i++) {
-    nonce += Math.round(Number(new Date()) * Math.random());
-  }
+  const nonce = bytes
+    .map((byte) => {
+      return byte % 10;
+    })
+    .join('');
 
-  const str = nonce.substr(nonce.length - length);
-  return str;
+  return nonce;
 }