-
Notifications
You must be signed in to change notification settings - Fork 29
Open
Description
Hello there
I audited the code because the interface is weird; generally, generating a secure random in javascript is a blocking operation, and fernet.js generate IVs without exposing the async interface.
Turns out you are using the blocking version of randomBytes
(https://github.com/csquared/fernet.js/blob/2eaa1c/fernet.js#L49).
Consider switching to the promisified version.
const asyncRandomBytes = promisify(randomBytes); // declaration
await asyncRandomBytes(128 / 8); // usage
But probably require a major version bump because the interface will be changed.
What are your takes on this?
Metadata
Metadata
Assignees
Labels
No labels