insufficient-randomness-anti-pattern

To detect weak random number generators in security-sensitive code, review the logic for predictable functions like Math.random() or Python's random module when generating tokens, session IDs, or encryption keys to identify predictable values.

Using Math.random() for token generation creates a vulnerability because it relies on predictable pseudo-random number generators, allowing attackers to guess or derive sensitive identifiers and compromise the system through token forgery.

The best way to securely generate session IDs and password reset tokens is to replace weak PRNGs with cryptographically secure pseudo-random number generators (CSPRNGs) like crypto.randomBytes() in Node.js or secrets in Python to ensure adequate entropy.

You cannot use Python's random module for generating API keys because it is a non-cryptographic generator. You must use the cryptographically secure secrets module instead to ensure the generated API keys are truly unpredictable.

Java provides the SecureRandom class as a built-in cryptographically secure pseudo-random number generator (CSPRNG). You should use SecureRandom instead of standard random classes to enforce adequate entropy for robust security.

You should not use standard random number generation in security-sensitive contexts such as creating session IDs, API keys, or encryption keys. Standard PRNGs lack the necessary entropy and must be replaced with language-specific CSPRNGs to prevent attacks.