fix: use randomBytes() instead of Math.random() for OAuth state generation (#145)

Author: MehtabSandhu11

apps/backend/src/routes/auth.ts

@@ -1,5 +1,5 @@
 import type { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
-
+import { randomBytes } from 'crypto';
 const GITHUB_AUTH_URL = 'https://github.com/login/oauth/authorize';
 const GITHUB_TOKEN_URL = 'https://github.com/login/oauth/access_token';
 const GITHUB_USER_URL = 'https://api.github.com/user';
@@ -287,5 +287,5 @@ export async function authRoutes(app: FastifyInstance) {
 }
 
 function generateState(): string {
-  return Math.random().toString(36).substring(2, 15);
+  return randomBytes(32).toString('hex');
 }

apps/backend/src/routes/connect.ts

@@ -170,5 +170,5 @@ function parseGoogleState(state: string): ParsedOAuthState | null {
 }
 
 function generateState(): string {
-  return Math.random().toString(36).substring(2, 15);
+  return randomBytes(32).toString('hex');
 }