eggjs / egg-security

Security plugin for egg, force performance too.
MIT License
238 stars 43 forks source link

fix: user secure random generator #43

Closed ai closed 6 years ago

ai commented 6 years ago

rndm use Math.random which is predictable and non-secure. nanoid uses hardware random generator which is much faster.

Also nanoid is very fast and popular tool.

codecov[bot] commented 6 years ago

Codecov Report

Merging #43 into master will not change coverage. The diff coverage is 100%.

Impacted file tree graph

@@           Coverage Diff           @@
##           master      #43   +/-   ##
=======================================
  Coverage   95.83%   95.83%           
=======================================
  Files          30       30           
  Lines         480      480           
=======================================
  Hits          460      460           
  Misses         20       20
Impacted Files Coverage Δ
app/extend/context.js 100% <100%> (ø) :arrow_up:
lib/middlewares/hsts.js 100% <0%> (ø) :arrow_up:
lib/safe_redirect.js 100% <0%> (ø) :arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update ca20599...899451a. Read the comment docs.

ai commented 6 years ago

@fengmk2 Good news, everyone :).

  1. My Chinese friends added Chinese docs
  2. We improved nanoid/non-secure performance and now we are 10% faster
$ ./test/benchmark
nanoid                354,201 ops/sec
nanoid/generate       348,467 ops/sec
uid.sync              325,347 ops/sec
uuid/v4               322,328 ops/sec
shortid                33,277 ops/sec

Async:
uid                    71,998 ops/sec
nanoid/async           72,836 ops/sec

Non-secure:
rndm                2,495,324 ops/sec
nanoid/non-secure   2,746,033 ops/sec
fengmk2 commented 6 years ago

@ai thanks a lot!