{"record":{"id":"049103ca1835e326","repo":"quasarframework/quasar","slug":"quasar-uid-secure-rng-not-available-cannot-ge","errorCode":null,"errorMessage":"[Quasar uid()] Secure RNG not available. Cannot generate collision-resistant UUID.","messagePattern":"\\[Quasar uid\\(\\)\\] Secure RNG not available\\. Cannot generate collision-resistant UUID\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"critical","filePath":"ui/src/utils/uid/uid.js","lineNumber":4,"sourceCode":"function createUidFn() {\n  if (typeof crypto === 'undefined') {\n    return () => {\n      throw new Error(\n        '[Quasar uid()] Secure RNG not available. Cannot generate collision-resistant UUID.'\n      )\n    }\n  }\n\n  // Fast Path: Native C++/Rust implementation (Node.js & HTTPS Browsers)\n  if (crypto.randomUUID) return () => crypto.randomUUID()\n\n  // Pre-compute hex map for the HTTP fallback\n  const hex = Array.from({ length: 256 }, (_, i) =>\n    (i + 0x1_00).toString(16).slice(1)\n  )\n  let buf, bufIdx\n\n  return () => {\n    if (buf === void 0 || bufIdx + 16 > 4096) {\n      bufIdx = 0\n      buf = new Uint8Array(4096)","sourceCodeStart":1,"sourceCodeEnd":22,"githubUrl":"https://github.com/quasarframework/quasar/blob/4841521b5f635a971eb9e2710e5542efd194691b/ui/src/utils/uid/uid.js#L1-L22","documentation":"Quasar's uid() utility generates collision-resistant UUIDv4 values and requires a Web Crypto-like global. If the global `crypto` object is undefined at module init, createUidFn() returns a function that always throws this error instead of silently producing weak IDs. Quasar refuses to generate non-cryptographic IDs because they could collide or be predictable.","triggerScenarios":"Calling Quasar.uid() (or rendering code that relies on it) in an environment lacking a global `crypto`: non-HTTPS browsers without crypto.getRandomValues, ancient browsers, non-secure contexts (plain HTTP origins in some browsers), minimal Node/embedded runtimes, or stripped-down SSR sandboxes where `crypto` is not exposed.","commonSituations":"Serving a Quasar SPA over plain HTTP on an intranet host viewed in an older browser; running the app in a webview with Web Crypto disabled; test environments (jsdom without crypto polyfill) exercising uid()-dependent components.","solutions":["Serve the app over HTTPS (or localhost), which makes browsers expose the Web Crypto API.","Polyfill `globalThis.crypto` (e.g. @peculiar/webcrypto or node:crypto's webcrypto) before the app boots.","If IDs need not be secure, generate IDs with your own fallback (counter + timestamp + Math.random) instead of Quasar.uid()."],"exampleFix":"// before (insecure context, no crypto)\nimport { uid } from 'quasar'\nconst id = uid()\n\n// after (polyfill before app boot)\nimport { webcrypto } from 'node:crypto'\nif (typeof globalThis.crypto === 'undefined') {\n  globalThis.crypto = webcrypto\n}\nimport { uid } from 'quasar'\nconst id = uid()","handlingStrategy":"fallback","validationCode":"if (typeof crypto === 'undefined' || typeof crypto.getRandomValues !== 'function') {\n  console.warn('Web Crypto unavailable; uid() will throw')\n}","typeGuard":"function hasSecureCrypto() {\n  return typeof crypto !== 'undefined' &&\n    typeof crypto.getRandomValues === 'function'\n}","tryCatchPattern":"let id\ntry {\n  id = uid()\n} catch (err) {\n  // only this specific failure\n  id = 'id-' + Date.now().toString(36) + '-' + Math.random().toString(36).slice(2, 10)\n}","preventionTips":["Serve apps over HTTPS or localhost so browsers expose Web Crypto.","Polyfill globalThis.crypto for legacy webviews, jsdom tests and minimal Node runtimes.","Detect insecure contexts early (a boot-file check) rather than failing at first uid() call.","Don't rely on uid() for non-security IDs in environments you don't control — have a local fallback generator."],"tags":["crypto","uid","insecure-context","browser-compatibility"],"backgroundTag":"secure-rng-unavailable","analyzedSha":"4841521b5f635a971eb9e2710e5542efd194691b","analyzedAt":"2026-08-30T01:13:14.944Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}