{"action":"opened","issue":{"url":"https://api.github.com/repos/RangelReale/osin/issues/50","labels_url":"https://api.github.com/repos/RangelReale/osin/issues/50/labels{/name}","comments_url":"https://api.github.com/repos/RangelReale/osin/issues/50/comments","events_url":"https://api.github.com/repos/RangelReale/osin/issues/50/events","html_url":"https://github.com/RangelReale/osin/issues/50","id":56029455,"number":50,"title":"Osin generates very similar tokens","user":{"login":"Ligustah","id":529376,"avatar_url":"https://avatars.githubusercontent.com/u/529376?v=3","gravatar_id":"","url":"https://api.github.com/users/Ligustah","html_url":"https://github.com/Ligustah","followers_url":"https://api.github.com/users/Ligustah/followers","following_url":"https://api.github.com/users/Ligustah/following{/other_user}","gists_url":"https://api.github.com/users/Ligustah/gists{/gist_id}","starred_url":"https://api.github.com/users/Ligustah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Ligustah/subscriptions","organizations_url":"https://api.github.com/users/Ligustah/orgs","repos_url":"https://api.github.com/users/Ligustah/repos","events_url":"https://api.github.com/users/Ligustah/events{/privacy}","received_events_url":"https://api.github.com/users/Ligustah/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-01-30T12:48:50Z","updated_at":"2015-01-30T12:48:50Z","closed_at":null,"body":"Hi there,\r\n\r\nI used this library for a small project a few months ago and it worked flawlessly.\r\nHowever, when I came back to using it for a new project, I noticed that the tokens that are generated by osin look very similar (AccessToken & RefreshToken that is).\r\n\r\nHere is a short program demonstrating the issue https://gist.github.com/Ligustah/bee3217f5b6c037bbf78 , which I think was introduced here: https://github.com/RangelReale/osin/pull/45\r\n\r\nTo see the difference please compare:\r\nhttps://godoc.org/code.google.com/p/go-uuid/uuid#NewUUID\r\nhttps://godoc.org/code.google.com/p/go-uuid/uuid#New\r\n\r\nNow I'm not too sure as to what the implications of this are, but it think it defeats the purpose of the long lived refresh token vs. short lived access token, when it's trivial to easily guess the refresh token given a specific access token.\r\n\r\nI suggest that you provide a default token generator that uses actually secure random tokens, which is fairly trivial using the standard library and doesn't require UUIDs at all.\r\n\r\nNot sure if below code compiles, but I'm using a similar piece of code for another project and assuming crypto/rand is reliable it will generate fairly secure random tokens.\r\n\r\n```\r\nimport (\r\n    \"crypto/rand\"\r\n    \"encoding/base64\"\r\n)\r\n\r\nfunc generateToken(length int) (secret string, err error) {\r\n\tvar buf = make([]byte, length)\r\n\t_, err = rand.Read(buf)\r\n\tsecret = base64.URLEncoding.EncodeToString(buf)\r\n\r\n\treturn\r\n}\r\n```\r\n\r\n"}}