TS · security

←Previous Next→

no-insecure-random-id

Disallow using Math.random() to generate identifiers, tokens, or secrets; use crypto.randomUUID() or crypto.getRandomValues(...) instead.

insecureRandomId Rule source Tests Catalog JSON

Why

Math.random is predictable and lacks the entropy required for security-sensitive values.

Fix

Generate the value with crypto.randomUUID or crypto.getRandomValues.

Examples

Before — flagged Do not derive a token from Math.random

src/session.ts

const sessionToken = Math.random();

After — preferred Use the Web Crypto API

src/session.ts

const sessionToken = crypto.randomUUID();