Generated WebSocket masks use a secure PRNG by default:

This resolves a medium vulnerability described in the
Beast Hybrid Assessment Report by Bishop Fox, where masks generated
for use with outgoing WebSocket client frames use an insufficient
source of entropy and a non-cryptographically secure pseudo-random
number generator.

By default, all newly constructed WebSocket streams will use a
uniquely seeded secure PRNG (ChaCha20 in counter mode). As this may
result in increased CPU resource consumption, the function
websocket::stream::secure_prng() may be used to select a faster but
less secure PRNG, for the case where the caller knows that the secure
generator is not necessary.

On some systems, std::random_device may produce insufficient entropy
to securely seed the PRNG. As this condition cannot be detected by
Beast, callers may use the function websocket::seed_prng() called
once at startup to provide at least 256 bits of entropy which will
be used to uniquely seed all subsequent PRNGs.

test/beast/websocket/stream.cpp

@@ -22,6 +22,11 @@ public:
     void
     testOptions()
     {
+        {
+            std::seed_seq ss{42};
+            seed_prng(ss);
+        }
+
         stream<test::stream> ws{ioc_};
         ws.auto_fragment(true);
         ws.write_buffer_size(2048);
@@ -37,6 +42,9 @@ public:
             pass();
         }
 
+        ws.secure_prng(true);
+        ws.secure_prng(false);
+
         auto const bad =
         [&](permessage_deflate const& pmd)
         {