Use of uid2

[benweet]

I've seen in your examples you mostly use uid2 for unique id generation which is now (in version 0.0.3) using node's crypto.pseudoRandomBytes(). As stated in the documentation, these ids are not necessarily unpredictable, which means not good for token generation. I think uid2 should be replaced with something using crypto.randomBytes() to prevent mistakes.

[benweet]

Interesting: https://github.com/senchalabs/connect/issues/932. As I understand, randomBytes and pseudoRandomBytes have pretty much the same behavior on every platform so far.

[markstos]

I would also like to see uid2 replaced. pseudoRandomBytes is not documented to return cryptographically secure random strings. The module has also has no README and no link to the source code from the NPM page. Bleh.

The secure-random-string module would be a near-drop-in replacement that's cryptographically secure. It includes options to only use alpha-numeric characters in the string to be URL friendly, and also lets you set the length of the secure random string that you want.

[knoxcard]

go with https://www.npmjs.com/package/uid-safe or https://www.npmjs.com/package/uuid