Security: Invoice ID hashes must be completely random about baron HOT 7 CLOSED

Reminder: Add check in the app to warn and refuse to operate if couchdb is configured to use non-random UUID's. random or utc_random would be fine.

from baron.

This seems to just be a configuration issue within couch, not necessarily a bug within baron. Will leave this open for reference.

from baron.

Resolve via couch configuration.

from baron.

Assigning to self.

I would like to add a highly visible warning to the admin if they use it with the wrong UUID algorithm. It's too easy for them to deploy it that way when its the default.

from baron.

Maybe we can start by adding something in the readme mentioning this couch setting.

from baron.

Would it be wrong to test it at runtime? If two hashes have the same prefix then baron should just refuse to run.

from baron.

It's fine if we implement a check in the future. I just meant in the meantime we could mention it in bold on the readme.

from baron.