LearnBoost/socket.io — pull request #857 by martinthomson (2012-04-26 22:42:54+00:00)
Title: Fix for ID generation vulnerability #856

Using crypto.randomBytes to generate a session ID. 96 bits of randomness, 24 bits of sequence number. Using the URL safe base64 encoding [RFC 4648](http://tools.ietf.org/html/rfc4648#section-5) to represent the value.

Backward compatibility for node 0.4 uses an insecure generation method with Math.random(). I could fix this too, but I don't believe that this version of node is still popular enough to justify the effort.