Suppose I want this on my `User` entity:

```
user.createNewSecurityToken();

```

That means:

```
public void createNewSecurityToken() {
  var buffer = new byte[32];
  new RNGCryptoServiceProvider().GetBytes(buffer);  // <--- here's the issue
  this.Token = Convert.ToBase64String(buffer);
}

```

This is not a DI dependency, just a class from the infrastructure. But does that "break" DDD?

The alternative is this:

```
user.setSecurityToken(token);   // pass it in (probably from a domain service)

```

But that leads to anemic entities.

Which is the preferred DDD approach, and what considerations should I take into account when faced with this sort of design decision?

*UPDATE*

Based on comments below, this leads to a more general question: what can I / can't I use in an entity? Domain services, application services, infrastructure services, framework classes, etc. - I know I can't inject DI-based services, or use infrastructure services, but what about the rest? What should I not use inside an entity?