Back to all reviewers

prefer standard crypto functions

cloudflare/workers-sdk
Based on 1 comments
TypeScript

Use Node.js built-in crypto module functions instead of third-party cryptographic libraries when possible. The built-in crypto module is well-maintained, follows established standards, and provides better security guarantees than external alternatives.

Security TypeScript

Reviewer Prompt

Use Node.js built-in crypto module functions instead of third-party cryptographic libraries when possible. The built-in crypto module is well-maintained, follows established standards, and provides better security guarantees than external alternatives.

Standard crypto functions are more likely to receive security updates, have been thoroughly vetted, and reduce dependency risks. They also provide consistent behavior across different environments.

Example:

// Prefer this
const crypto = require('crypto');
const hash = crypto.createHash('sha256').update(data).digest('hex');

// Instead of
const hash = blake3hash(data).toString('hex');

This applies to hash functions, encryption, and other cryptographic operations where Node.js provides built-in alternatives.

1
Comments Analyzed
TypeScript
Primary Language
Security
Category

Source Discussions