I was surprised to see that there is no "built-in" mechanism in JS to generate a GUID. As a C# dev, I'm used to Guid.NewGuid()
https://gist.github.com/jed/982883
If you google "generate uuid javascript" you can find approaches from Math.random to node/browser `crypto` module to shelling out OS random.
One of the main benefits of guid generation is that you don't need to synchronize with anything to generate a unique ID, so it's weird to incur an http request, especially to someone else's service. At that point you might as well just phone home to your own service.
Most people format 128-bit random numbers into a UUID just so it's obvious at a glance what it is: a guid. Even if it's not technically a UUIDv4 because it doesn't have the magic bits.
window.crypto.getRandomValues() should be used instead.
The quality and seeding of Math.random() is implementation-dependent and not generally good enough everywhere to prevent collisions. Many seed with the just the system time.
Source: I have personally seen such collisions in a production web app with 700k users. A Web search for “Javacsript GUID collision” shows that many others have as well. We switched to the cryptographic generator and the collisions disappeared.
That seems hyperbolic to me. If you rely on UUID for security, it seems, to me, something is wrong in your architecture and the security flaw lies there.
When would you, legitimate, rely on GUID/UUID for security?
Math.random().toString(32).slice(2,10)