search

bugsnag / bugsnag-js

JavaScript error handling tool for BugSnag. Monitor and report JavaScript bugs & errors.
https://docs.bugsnag.com/platforms/javascript
MIT License
855 stars 251 forks source link

Cuid is deprecated due to security. The same security issues apply to all k-sortable ids and all UUIDs. #1912

Open ericelliott opened 1 year ago

ericelliott commented 1 year ago

Please upgrade to Cuid2.

Cuid has been deprecated due to security concerns. Likewise, UUID V4 may be insecure due to its reliance on the web crypto APIs, whose random number generators have historically gone years with known bugs that break cryptographic security (details in the Cuid2 documentation). All other UUIDs leak information which may be exploited.

Other ids that share these security concerns include Ulid, Snowflake, ShardingId, pushId, ObjectId, and KSUID. NanoId shares the same dependence on the web crypto API as UUID V4.

johnkiely1 commented 1 year ago

Hi @ericelliott,

Thanks for raising, we've added this to our backlog. We would like to move to cuid2 but backward compatibility would be the the concern and will require some additional thought and effort on our part. We will update here as soon we have any more information to share.