Generate tokens with CSPRNG

Package hat, used to generate session and some other tokens uses
non-cryptographic random number generator. Replace it with the
cryptographically secure one. The result has the same format
(32-character hex string, 128 bits of entropy).

Author: dchest

src/RestWrite.js

@@ -4,7 +4,6 @@
 
 var crypto = require('crypto');
 var deepcopy = require('deepcopy');
-var rack = require('hat').rack();
 
 var Auth = require('./Auth');
 var cache = require('./cache');
@@ -252,7 +251,7 @@ RestWrite.prototype.handleFacebookAuthData = function() {
         throw new Parse.Error(Parse.Error.ACCOUNT_ALREADY_LINKED,
                               'this auth is already used');
       } else {
-        this.data.username = rack();
+        this.data.username = crypto.randomBytes(16).toString('hex');
       }
 
       // This FB auth does not already exist, so transform it to a
@@ -273,7 +272,7 @@ RestWrite.prototype.transformUser = function() {
   var promise = Promise.resolve();
 
   if (!this.query) {
-    var token = 'r:' + rack();
+    var token = 'r:' + crypto.randomBytes(16).toString('hex');
     this.storage['token'] = token;
     promise = promise.then(() => {
       var expiresAt = new Date();
@@ -412,7 +411,7 @@ RestWrite.prototype.handleSession = function() {
   }
 
   if (!this.query && !this.auth.isMaster) {
-    var token = 'r:' + rack();
+    var token = 'r:' + crypto.randomBytes(16).toString('hex');
     var expiresAt = new Date();
     expiresAt.setFullYear(expiresAt.getFullYear() + 1);
     var sessionData = {

src/users.js

@@ -2,7 +2,7 @@
 
 var mongodb = require('mongodb');
 var Parse = require('parse/node').Parse;
-var rack = require('hat').rack();
+var crypto = require('crypto');
 
 var Auth = require('./Auth');
 var passwordCrypto = require('./password');
@@ -54,7 +54,7 @@ function handleLogIn(req) {
         throw new Parse.Error(Parse.Error.OBJECT_NOT_FOUND,
                               'Invalid username/password.');
       }
-      var token = 'r:' + rack();
+      var token = 'r:' + crypto.randomBytes(16).toString('hex');
       user.sessionToken = token;
       delete user.password;