v0.34.0_7

src/proxy/request_id.rs

@@ -1,14 +1,13 @@
 fn request_id_hash(sequence: u64) -> String {
-    use sha2::{Digest, Sha256};
-
-    // Thread-local CSPRNG is seeded (and periodically reseeded) from the OS.
-    // Do not make a getrandom syscall on the hot path for every HTTP request.
-    // Keep hashing the per-process sequence as before for the same ID format.
-    let nonce: [u8; 32] = rand::random();
-    let mut hash = Sha256::new();
-    hash.update(sequence.to_be_bytes());
-    hash.update(nonce);
-    request_id_hex(&hash.finalize())
+    // Same thread-local CSPRNG as before, now with no per-request SHA-256.
+    // XORing an increasing sequence into independent uniformly random bytes
+    // preserves the full 256-bit unpredictability and 64-hex-character shape.
+    // The sequence is still mixed in; this is not a predictable counter ID.
+    let mut token: [u8; 32] = rand::random();
+    for (byte, sequence_byte) in token[..8].iter_mut().zip(sequence.to_be_bytes()) {
+        *byte ^= sequence_byte;
+    }
+    request_id_hex(&token)
 }
 
 fn request_id_hex(digest: &[u8]) -> String {