> Shouldn't this be 'Javascript UUIDs generally do not meet security requirements' ? Nothing wrong with v4 UUIDs generated in Javascript, so long as you don't

> Shouldn't this be 'Javascript UUIDs generally do not meet security requirements' ? Nothing wrong with v4 UUIDs generated in Javascript, so long as you don't use Math.random(). Every current browser supports, eg, crypto.getRandomValues(), which is cryptographically secure. If you use a broken PRNG in any other language, you'll get broken v4 UUIDs too. :) (Also, don't make the common mistake of conflating "UUID" with "v4 UUID". A v4 UUID contains 122 bits of (hopefully) random data. A v1 UUID contains 0 bits of randomness.)