> Math.random() does not provide cryptographically secure random numbers. Do not use them for anything related to security. Use the Web Crypto API instead, and more precisely the window.crypto.getRandomValues() method.
Also, even if you had a CSPRNG there, your URL format seems to encode only about 27 bits of data.
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
> Math.random() does not provide cryptographically secure random numbers. Do not use them for anything related to security. Use the Web Crypto API instead, and more precisely the window.crypto.getRandomValues() method.
Also, even if you had a CSPRNG there, your URL format seems to encode only about 27 bits of data.