Skip to content
Sarj Standards

TypeScript · security

no-insecure-random-id

eslint:no-insecure-random-id

Disallow using `Math.random()` to generate identifiers, tokens, or secrets; use `crypto.randomUUID()` or `crypto.getRandomValues(...)` instead.

Default
error
Fix
none
Languages
typescript

Why

Math.random is predictable and lacks the entropy required for security-sensitive values.

Fix

Generate the value with crypto.randomUUID or crypto.getRandomValues.

Before / after

Executed by this rule’s unit tests.

Before

Do not derive a token from Math.random

src/session.ts · focus
const sessionToken = Math.random();

After

Use the Web Crypto API

src/session.ts · focus
const sessionToken = crypto.randomUUID();

Limits

  • Ambiguous identifiers and test files are excluded to avoid flagging sampling and fixture data.

Message IDs

insecureRandomId