Potential fix for code scanning alert no. 5: Insecure randomness

[jonathansantilli]

Potential fix for https://github.com/jonathansantilli/codegate/security/code-scanning/5

In general, to fix this kind of issue you should avoid Math.random() for any value that is treated as an identifier, token, or anything that could be relied on for uniqueness or secrecy, and instead use a cryptographically secure random generator such as crypto.randomBytes (Node) or crypto.getRandomValues (browser). This ensures the generated value is not trivially predictable and has sufficient entropy.

For this specific file, the best fix is to replace the nonce generation inside sessionIdFromNow() to use randomBytes from Node’s crypto module, and to add the corresponding import. We can generate a short hexadecimal string with randomBytes(3).toString("hex"), which yields 6 hex characters like the current slice(2, 8) call, so existing formats remain essentially unchanged. Concretely:

• Update the import line to include randomBytes from "node:crypto".
• Change line 72 from Math.random().toString(16).slice(2, 8); to a call to randomBytes(3).toString("hex");.
  No other logic needs to change, so functionality is preserved aside from stronger randomness.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.