Not use math.random for generating secrets

[hilmer-martin]

Is your feature request related to a problem? Please describe. Currently a client_secret will be generated with Math.random. This is not recommended because it is not cryptographically secure.

Describe the solution you'd like The solution would be to use the crypto api instead.

https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/generateKey

Describe alternatives you've considered

Additional context

[skoruba]

Thank you for your suggestion - are you interested to send a PR for it?

[hilmer-martin]

Yes, I will prepare one.

Thank you for your fast feedback.

I'll take code snippet from https://nicozerpa.com/never-use-math-random-for-passwords/ for secret generation.

Now I'm stuck on bundling (and testing) because of errors while running npm install

I will invest more time tomorrow.

[skoruba]

Very good, thanks for your time 👌🏻

[rosenbach]

I handed in a PR that would fix this: #153