OpenNHP/opennhp · critical

fail to generate session id

Error message

fail to generate session id: %w

What it means

generateSecureSessionID reads 32 random bytes from crypto/rand to build the KBS session id. This error is returned when rand.Read fails, meaning the OS cryptographic random source is unavailable. The OS error is wrapped in 'fail to generate session id: %w'.

Solutions

1. Fix the host/container so /dev/urandom and the getrandom syscall are available
2. Inspect the wrapped error to identify the syscall failure (getrandom ENOSYS/EAGAIN)
3. Remove custom seccomp/AppArmor rules blocking getrandom(2)
4. If transient EAGAIN, retry rand.Read before failing the request

sessionID, err := generateSecureSessionID()
if err != nil {
	log.Errorf("session id generation failed: %v", err)
	http.Error(w, "internal error", http.StatusInternalServerError)
	return
}

When it happens

Trigger: Auth calls generateSecureSessionID and rand.Read returns an error — practically only when the OS entropy source is broken (e.g. /dev/urandom unavailable, getrandom syscall failure).

Common situations: Running in a container/sandbox with a broken /dev/urandom; extremely restricted seccomp profiles blocking getrandom; corrupted host OS; this is very rare in production Linux.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• failed to generate UUID v4
• unknown remote provider
• unknown remote provider
• unsupported key type, expect RSA
• JWT signing key is not initialized

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/fb9cf81498d8bbda. Report an issue: GitHub.

Appendix: source

Thrown at endpoints/server/kbs/auth/auth.go:40

	Nonce       string `json:"nonce"`
	ExtraParams string `json:"extra-params"`
}

func generateNonce() (string, error) {
	b := make([]byte, 32)
	_, err := rand.Read(b)
	if err != nil {
		return "", err
	}

	return base64.StdEncoding.EncodeToString(b), nil
}

func generateSecureSessionID() (string, error) {
	randomBytes := make([]byte, 32)
	_, err := rand.Read(randomBytes)
	if err != nil {
		return "", fmt.Errorf("fail to generate session id: %w", err)

	}

	return hex.EncodeToString(randomBytes), nil
}

func Auth(c *gin.Context) {
	var req AuthRequest

	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, kbsError.InvalidRequest(err))
		return
	}

	nonce, err := generateNonce()
	if err != nil {
		c.JSON(http.StatusInternalServerError, kbsError.NonceGenerationFailed(err))
		return

View on GitHub (pinned to 6e04ca5ff0)