fix: use randomBytes() instead of Math.random() for OAuth state gener…

[MehtabSandhu11]

Summary

Fixes the generateState() function in auth.ts and connect.ts by replacing the insecure Math.random() implementation with a cryptographically secure random value for the OAuth state parameter.

Problem

The previous implementation used:

function generateState(): string {
  return Math.random().toString(36).substring(2, 15);
}

Math.random() is not cryptographically secure and can produce predictable values. Since the OAuth state parameter is used to prevent CSRF attacks, predictable state values weaken this protection.

Fix

Replaced the implementation with randomBytes() from Node.js' built-in crypto module:

import { randomBytes } from 'crypto';

function generateState(): string {
  return randomBytes(32).toString('hex');
}

This generates 256 bits of cryptographically secure randomness, making the OAuth state parameter unpredictable and resistant to CSRF attacks.

Files Changed

• apps/backend/src/routes/auth.ts
• apps/backend/src/routes/connect.ts

Related

Closes #123

[Harxhit]

@ShantKhatri These changes look good to merge. Please review them and provide the final approval.

[ShantKhatri]

Hi @MehtabSandhu11 , we appreciate your contribution and also the PR standards you followed. Once again thanks for the contribution.