Web Security · Senior · Question 41 of 75

Which source of randomness should be used for session IDs and reset tokens in a browser or Node.js?

✓Correct answer: A CSPRNG: crypto.getRandomValues(), crypto.randomUUID() or crypto.randomBytes()
2The current timestamp with the user ID
3Math.random(), converted to a string

Explanation

Math.random() isn't designed to be unpredictable. Security tokens need a cryptographically secure generator.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.