Weak Random (ARCH5115)

Key go.security.weak-random · Severity warning · Category security · CWE CWE-338

math/rand is non-cryptographic and predictable; using it for security values like tokens, keys, salts, or session ids lets attackers predict them.

Incorrect

func token() string {
  b := make([]byte, 16)
  for i := range b {
    b[i] = byte(rand.Intn(256)) // math/rand
  }
  return hex.EncodeToString(b)
}

Correct

func token() (string, error) {
  b := make([]byte, 16)
  if _, err := rand.Read(b); err != nil { // crypto/rand
    return "", err
  }
  return hex.EncodeToString(b), nil
}

Fix

Use crypto/rand for all security-sensitive values; math/rand is only for non-security purposes.