Base.random_string should use SecureRandom.base64 about rack-protection

[namelessjon]

The amount of information in the two strings is identical. rack-protection calls SecureRandom.hex(32), rack_csrf calls SecureRandom.base64(32). They both call SecureRandom.random_bytes(n) under the hood (i.e. the argument is the number of random bytes, not the resultant string length after encoding), so they both generate 256bit random strings. You could argue it should use the Base64 encoding to make a more compact string which is 20 less bytes to send on a page, store in a cookie etc, but security wise, they're identical.

[acrispino]

You're right about that, now I don't even know what I was thinking. I may mixed up the outputs from a couple different windows I had open. ugh. Closing this because I was dumb.