richardsonjf / uuid

UUID V4

uuid

This is the repository for the WICG uuid Specification. You're welcome to contribute!

Implementation status

• Chromium - Shipping 92.
• Gecko - Work in progress.
• WebKit - Implemented, not shipped yet.

Other runtimes

• Deno - v1.11.
• Node.js - v14.17.0.

Usage example

const uuid = crypto.randomUUID();

Motivation

UUID generation is a common software requirement

The uuid library on npm currently receives 131,000,000 monthly downloads and is relied on by over 2,600,000 repositories (as of June 2019).

The ubiquitous nature of the uuid module demonstrates that UUID generation is a common requirement for JavaScript software applications, making the functionality a good candidate for the standard library.

Developers "re-inventing the wheel" is potentially harmful

Developers who have not been exposed to RFC4122 might naturally opt to invent their own approaches to UUID generation, potentially using Math.random().

There's an in-depth discussion of why a Cryptographically-Secure-Pseudo-Random-Number-Generator (CSPRNG) should be used when generating UUIDs. Of primary concern is that, without a high-quality source of randomness, collisions can frequently occur.

Introducing a UUID standard library, which dictates that a CSPRNG must be used, helps protect developers from security pitfalls.

Potential future work

Support for additional UUID formats

If compelling use cases are found for other UUID formats, the API might be extended to support them. If this is of interest to you, please join the discussion in issue #36.

Add isValidUUID method

In reviewing chromium#2804758, @mikewest suggested:

For the future: I wonder whether it's worth exposing WTF::IsValidUUID as well, as an analog to the uuid.validate() method in the UUID npm package?

It would be worth exploring if users would find exposing this method useful.