package osin

import (
	"encoding/base64"
	"strings"

	"code.google.com/p/go-uuid/uuid"
)

// AuthorizeTokenGenDefault is the default authorization token generator
type AuthorizeTokenGenDefault struct {
}

func removePadding(token string) string {
	return strings.TrimRight(token, "=")
}

// GenerateAuthorizeToken generates a base64-encoded UUID code
func (a *AuthorizeTokenGenDefault) GenerateAuthorizeToken(data *AuthorizeData) (ret string, err error) {
	token := uuid.NewRandom()
	return removePadding(base64.URLEncoding.EncodeToString([]byte(token))), nil
}

// AccessTokenGenDefault is the default authorization token generator
type AccessTokenGenDefault struct {
}

// GenerateAccessToken generates base64-encoded UUID access and refresh tokens
func (a *AccessTokenGenDefault) GenerateAccessToken(data *AccessData, generaterefresh bool) (accesstoken string, refreshtoken string, err error) {
	token := uuid.NewRandom()
	accesstoken = removePadding(base64.URLEncoding.EncodeToString([]byte(token)))

	if generaterefresh {
		rtoken := uuid.NewRandom()
		refreshtoken = removePadding(base64.URLEncoding.EncodeToString([]byte(rtoken)))
	}
	return
}

package osin

import (
	"encoding/base64"
	"strings"

	"code.google.com/p/go-uuid/uuid"
)

// AuthorizeTokenGenDefault is the default authorization token generator
type AuthorizeTokenGenDefault struct {
}

func removePadding(token string) string {
	return strings.TrimRight(token, "=")
}

// GenerateAuthorizeToken generates a base64-encoded UUID code
func (a *AuthorizeTokenGenDefault) GenerateAuthorizeToken(data *AuthorizeData) (ret string, err error) {
	token := uuid.NewUUID()
	return removePadding(base64.URLEncoding.EncodeToString([]byte(token))), nil
}

// AccessTokenGenDefault is the default authorization token generator
type AccessTokenGenDefault struct {
}

// GenerateAccessToken generates base64-encoded UUID access and refresh tokens
func (a *AccessTokenGenDefault) GenerateAccessToken(data *AccessData, generaterefresh bool) (accesstoken string, refreshtoken string, err error) {
	token := uuid.NewUUID()
	accesstoken = removePadding(base64.URLEncoding.EncodeToString([]byte(token)))

	if generaterefresh {
		rtoken := uuid.NewUUID()
		refreshtoken = removePadding(base64.URLEncoding.EncodeToString([]byte(rtoken)))
	}
	return
}

--- 
+++ 
@@ -17,7 +17,7 @@
 
 // GenerateAuthorizeToken generates a base64-encoded UUID code
 func (a *AuthorizeTokenGenDefault) GenerateAuthorizeToken(data *AuthorizeData) (ret string, err error) {
-	token := uuid.NewUUID()
+	token := uuid.NewRandom()
 	return removePadding(base64.URLEncoding.EncodeToString([]byte(token))), nil
 }
 
@@ -27,11 +27,11 @@
 
 // GenerateAccessToken generates base64-encoded UUID access and refresh tokens
 func (a *AccessTokenGenDefault) GenerateAccessToken(data *AccessData, generaterefresh bool) (accesstoken string, refreshtoken string, err error) {
-	token := uuid.NewUUID()
+	token := uuid.NewRandom()
 	accesstoken = removePadding(base64.URLEncoding.EncodeToString([]byte(token)))
 
 	if generaterefresh {
-		rtoken := uuid.NewUUID()
+		rtoken := uuid.NewRandom()
 		refreshtoken = removePadding(base64.URLEncoding.EncodeToString([]byte(rtoken)))
 	}
 	return
Use NewRandom instead of NewUUID

NewUUID is based on a timestamp, while NewRandom
is based on a PRNG, like it should be.
