javascript - correct way to exclude certain characters from crypto.randomBytes -

i have following code, based on http://nodejs.org/docs/v0.6.9/api/crypto.html#randombytes

crypto.randombytes 32, (ex, buf) ->   user.tokenstring = buf.tostring("hex")   user.tokenexpires = date.now() + token_time   next() 

i using generate tokenstring use node.js/express user validation.

in cases tokenstring generated includes '/' forward slash character, , breaks routes, example, tokenstring if tokenstring '$2a$10$oyjn2r/ts.guywqx7ijtwo8cij80m.uiqv9njgtt18nqu8lt8oqpe' can't find /user/activate/$2a$10$oyjn2r , 404 error

is there more direct way exclude characters being included when generating crypto.randombytes?

crypto.randombytes generates random bytes . has nothing characters, characters determined way look @ bytes.

for example:

user.tokenstring = buf.tostring("hex") 

would convert buffer string (where 2 characters represent each byte), in character range 0-9a-f

another (might more suiting approach use more compact encoding. base64url encoding provides string encoding url/filename safe

user.tokenstring = base64url(buf) 

here an npm package can use it.

other that, code seems fine. if call .tostring() without specifying "hex" or specifying "ascii" example, break in question description.