Solved: How to generate a UUID via a cryptographically sec... - Page 2

dave_pickard · 09-16-2016 12:01 AM

Is there a way to generate a true random UUID in Apigee? I'm trying to generate a random UUID in javascript but am being told by our Security guys that Math.random isn't truly random. Is there a way to generate a truly random number without going into a Node back end?

DChiesa

EDIT (2021 February)

To get a true random uuid, use the static function createUuid from within a message template. Like this:

<AssignMessage name='AM-Uuid'>
  <AssignVariable>
    <Name>my-uuid</Name>
    <Template>{createUuid()}</Template>
  </AssignVariable>
</AssignMessage>

The UUID is generated using a cryptographically strong pseudo random number generator (PRNG).

OLD ANSWER - Still works but not necessary.

The Javascript versions may work just fine for your purposes. If you expect to run at higher load and concurrency, you will want to use Java.

I've built a simple, re-usable Java callout that uses java.security.SecureRandom to generate random numbers, and random UUIDs. Find it at https://github.com/DinoChiesa/ApigeeEdge-Java-SecureRandom.

Configure it like this:

<JavaCallout name='Java-PRNG-UUID'>
  <ClassName>com.dinochiesa.edgecallouts.SecureRandomCallout</ClassName>
  <Properties>
    <Property name='algorithm'>SHA1PRNG</Property>
    <Property name='output-type'>uuid</Property>
  </Properties>
  <ResourceURL>java://edge-java-callout-prng.jar</ResourceURL>
</JavaCallout>

This callout uses java.security.SecureRandom to generate UUIDs. It caches the SecureRandom (which is thread safe) so that the generation of new UUIDs will be fast at high concurrency.

It is ready to use; you do not need to build or compile it, in order to use it. But the source code is there so you can change or extend it as you need.

Apache 2.0 license.

View solution in original post

How to generate a UUID via a cryptographically secure random number generator in Apigee

EDIT (2021 February)

OLD ANSWER - Still works but not necessary.