What is the best practice for generating Coldfusion 10 random numbers?

Question

Do you still need to use Randomize if you are using RandRange with an algorithm? For example:

  RandRange(1, 37, "SHA1PRNG") 

Adobe documentation says:

SHA1PRNG: Generates a number using the Sun Java SHA1PRNG algorithm. This algorithm provides more randomness than the default algorithm.

It would be nice if there was one function providing the highest possible randomized sequence. The example provided by Adobe uses both Randomize and RandRange.

Any clarification would be appreciated.

Additional Information:

In this context, I select random characters from a list of about 40 to highlight a 7-character password. I would like to avoid duplicates, although there are separate (though not necessarily unique) usernames. Nothing financial or confidential is at stake - you just need to identify the users of the educational website.

Answer 1

If you are not repeating, you should reduce the range of randRange and select from the list of unused characters.

Of course, use RandRange with SHA1PRNG and don't worry about it.

You do not need randomization. It is only used for seeding random functions when you want a predictable random sequence for debugging purposes.

An alternative solution would be to shuffle the character collection with java.util.Collections shuffle (), then use left() to get the desired length of non-repeating characters. See: http://www.bennadel.com/blog/2284-Using-java-util-Collections-To-Shuffle-A-ColdFusion-Query-Column-Corrupts-Column-Values.htm