Skip to content

Improvement: use non-blocking version of randomBytes #24

@midnight-wonderer

Description

@midnight-wonderer

Hello there

I audited the code because the interface is weird; generally, generating a secure random in javascript is a blocking operation, and fernet.js generate IVs without exposing the async interface.

Turns out you are using the blocking version of randomBytes (https://github.com/csquared/fernet.js/blob/2eaa1c/fernet.js#L49).

Consider switching to the promisified version.

const asyncRandomBytes = promisify(randomBytes); // declaration
await asyncRandomBytes(128 / 8); // usage

But probably require a major version bump because the interface will be changed.
What are your takes on this?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions