Better OAuth2 random state string

Author: simov

lib/config.js

@@ -1,5 +1,6 @@
 'use strict'
 
+var crypto = require('crypto')
 var dcopy = require('deep-copy')
 
 // oauth configuration
@@ -48,7 +49,7 @@ exports.state = function (provider) {
     state = provider.state.toString()
   }
   else if (typeof provider.state == 'boolean' && provider.state) {
-    state = (Math.floor(Math.random() * 999999) + 1).toString()
+    state = crypto.randomBytes(10).toString('hex')
   }
   return state
 }

test/config.js

@@ -78,7 +78,7 @@ describe('config', function () {
     it('boolean true', function () {
       var provider = {state:true}
         , state = config.state(provider)
-      state.should.match(/\d+/)
+      state.should.match(/^\w+$/)
       state.should.be.type('string')
     })
     it('boolean false', function () {