unjs / crossws

🔌 Cross-platform WebSocket Servers for Node.js, Deno, Bun and Cloudflare Workers.
https://crossws.unjs.io
Other
394 stars 17 forks source link

feat(peer): use secure lazy random uuid #64

Closed pi0 closed 3 months ago

pi0 commented 3 months ago

Peer ids used to be derived from a global counter. This can lead to security issues if relying on id to identify clients and also expose server info.

Using randomUUID crypto utility, we lazily assign them random ids.

Uncrypto dep is added since sadly Node.js 18 is still a thing until mid next year it is EOL... (bundle overhead is almost zero for other runtimes)