quasarframework/quasar · critical · Error

[Quasar uid()] Secure RNG not available. Cannot generate col

Error message

[Quasar uid()] Secure RNG not available. Cannot generate collision-resistant UUID.

What it means

Quasar's uid() utility generates collision-resistant UUIDv4 values and requires a Web Crypto-like global. If the global `crypto` object is undefined at module init, createUidFn() returns a function that always throws this error instead of silently producing weak IDs. Quasar refuses to generate non-cryptographic IDs because they could collide or be predictable.

Source

Thrown at ui/src/utils/uid/uid.js:4

function createUidFn() {
  if (typeof crypto === 'undefined') {
    return () => {
      throw new Error(
        '[Quasar uid()] Secure RNG not available. Cannot generate collision-resistant UUID.'
      )
    }
  }

  // Fast Path: Native C++/Rust implementation (Node.js & HTTPS Browsers)
  if (crypto.randomUUID) return () => crypto.randomUUID()

  // Pre-compute hex map for the HTTP fallback
  const hex = Array.from({ length: 256 }, (_, i) =>
    (i + 0x1_00).toString(16).slice(1)
  )
  let buf, bufIdx

  return () => {
    if (buf === void 0 || bufIdx + 16 > 4096) {
      bufIdx = 0
      buf = new Uint8Array(4096)

View on GitHub (pinned to 4841521b5f)

Solutions

Serve the app over HTTPS (or localhost), which makes browsers expose the Web Crypto API.
Polyfill `globalThis.crypto` (e.g. @peculiar/webcrypto or node:crypto's webcrypto) before the app boots.
If IDs need not be secure, generate IDs with your own fallback (counter + timestamp + Math.random) instead of Quasar.uid().

Example fix

// before (insecure context, no crypto)
import { uid } from 'quasar'
const id = uid()

// after (polyfill before app boot)
import { webcrypto } from 'node:crypto'
if (typeof globalThis.crypto === 'undefined') {
  globalThis.crypto = webcrypto
}
import { uid } from 'quasar'
const id = uid()

Defensive patterns

Strategy: fallback

Validate before calling

if (typeof crypto === 'undefined' || typeof crypto.getRandomValues !== 'function') {
  console.warn('Web Crypto unavailable; uid() will throw')
}

Type guard

function hasSecureCrypto() {
  return typeof crypto !== 'undefined' &&
    typeof crypto.getRandomValues === 'function'
}

Try / catch

let id
try {
  id = uid()
} catch (err) {
  // only this specific failure
  id = 'id-' + Date.now().toString(36) + '-' + Math.random().toString(36).slice(2, 10)
}

Prevention

Serve apps over HTTPS or localhost so browsers expose Web Crypto.
Polyfill globalThis.crypto for legacy webviews, jsdom tests and minimal Node runtimes.
Detect insecure contexts early (a boot-file check) rather than failing at first uid() call.
Don't rely on uid() for non-security IDs in environments you don't control — have a local fallback generator.

When it happens

Trigger: Calling Quasar.uid() (or rendering code that relies on it) in an environment lacking a global `crypto`: non-HTTPS browsers without crypto.getRandomValues, ancient browsers, non-secure contexts (plain HTTP origins in some browsers), minimal Node/embedded runtimes, or stripped-down SSR sandboxes where `crypto` is not exposed.

Common situations: Serving a Quasar SPA over plain HTTP on an intranet host viewed in an older browser; running the app in a webview with Web Crypto disabled; test environments (jsdom without crypto polyfill) exercising uid()-dependent components.

AI-assisted analysis of quasarframework/quasar@4841521b5f (2026-08-30). Data as JSON: /api/errors/049103ca1835e326. Report an issue: GitHub.