Skip to content

fix(docs): replace Math.random() nonce with crypto.randomUUID() in Wagmi setup example#1398

Open
schoolkamsergj wants to merge 1 commit intobase:masterfrom
schoolkamsergj:fix/wagmi-nonce-crypto-randomuuid
Open

fix(docs): replace Math.random() nonce with crypto.randomUUID() in Wagmi setup example#1398
schoolkamsergj wants to merge 1 commit intobase:masterfrom
schoolkamsergj:fix/wagmi-nonce-crypto-randomuuid

Conversation

@schoolkamsergj
Copy link
Copy Markdown

Summary

Replaces the insecure Math.random() nonce generation with crypto.randomUUID() in the Wagmi integration setup example.

Problem

Math.random() is not cryptographically secure and should never be used for SIWE (Sign-In With Ethereum) nonces. A predictable nonce can be exploited to perform replay attacks.

Before:

const clientNonce =
  Math.random().toString(36).substring(2, 15) +
  Math.random().toString(36).substring(2, 15);

After:

// Generate a cryptographically secure nonce using Web Crypto API
const clientNonce = crypto.randomUUID();

Why crypto.randomUUID()

  • ✅ Cryptographically secure (uses the Web Crypto API)
  • ✅ Available in all modern browsers and Node.js 14.17+
  • ✅ Already used in the authenticate-users guide — keeps docs consistent
  • ✅ Returns a UUID v4 — more than sufficient entropy for a SIWE nonce

Fixes #1390

…gmi setup example

Closes base#1390

Math.random() is not cryptographically secure and should not be used
for SIWE nonces. Replaced with crypto.randomUUID() which is available
in all modern browsers and Node.js 14.17+, consistent with the
authenticate-users guide.
@cb-heimdall
Copy link
Copy Markdown
Collaborator

🟡 Heimdall Review Status

Requirement Status More Info
Reviews 🟡 0/2
Denominator calculation
Show calculation
1 if user is bot 0
1 if user is external 0
2 if repo is sensitive 0
From .codeflow.yml 1
Additional review requirements
Show calculation
Max 0
0
From CODEOWNERS 0
Global minimum 0
Max 1
1
1 if commit is unverified 1
Sum 2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(docs): replace Math.random() nonce with crypto.randomUUID() in Wagmi integration example

2 participants