Implement safe crypto

2025-04-28 20:22:39 +02:00
parent b5e96e02c3
commit 0fa4e1107b
5 changed files with 33 additions and 42 deletions
--- a/apps/hub/app/(auth)/passwort-reset/action.ts
+++ b/apps/hub/app/(auth)/passwort-reset/action.ts
@@ -16,7 +16,11 @@ export const resetPassword = async (email: string) => {
 			return { error: "Nutzer nicht gefunden" };
 		}

-		const password = Math.random().toString(36).slice(-8);
+		const array = new Uint8Array(8);
+		crypto.getRandomValues(array);
+		const password = Array.from(array, (byte) =>
+			("0" + (byte % 36).toString(36)).slice(-1),
+		).join("");
 		const hashedPassword = await bcrypt.hash(password, 12);
 		await prisma.user.update({
 			where: {