{"record":{"id":"1563030dd3a7e6b9","repo":"dapr/dapr","slug":"error-generating-nonce-w","errorCode":null,"errorMessage":"error generating nonce: %w","messagePattern":"error generating nonce: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/sentry/server/ca/jwt/jwt.go","lineNumber":139,"sourceCode":"\t}\n\tif i.signKey == nil {\n\t\treturn \"\", errors.New(\"JWT signing key is not available\")\n\t}\n\n\t// Create SPIFFE ID format string for the subject claim\n\tsubject, err := spiffeid.FromSegments(req.TrustDomain, \"ns\", req.Namespace, req.AppID)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"error creating SPIFFE ID: %w\", err)\n\t}\n\n\tnow := time.Now()\n\tnotBefore := now.Add(-i.allowedClockSkew) // Account for clock skew\n\tnotAfter := now.Add(req.TTL)\n\n\tjti, err := generateJwtID()\n\tif err != nil {\n\t\tlog.Errorf(\"Error generating nonce: %v\", err)\n\t\treturn \"\", fmt.Errorf(\"error generating nonce: %w\", err)\n\t}\n\n\t// Create JWT token with claims builder\n\tbuilder := jwt.NewBuilder().\n\t\tJwtID(jti).\n\t\tSubject(subject.String()).\n\t\tIssuedAt(now).\n\t\tAudience(req.Audiences).\n\t\tNotBefore(notBefore).\n\t\tClaim(\"use\", \"sig\"). // Needed for Azure\n\t\tExpiration(notAfter)\n\n\t// Set issuer only if configured\n\tif i.iss != nil {\n\t\tbuilder = builder.Issuer(*i.iss)\n\t}\n\n\t// Build the token","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/dapr/dapr/blob/74ad41702745709bb15fe2114ff693b8c59bc3cc/pkg/sentry/server/ca/jwt/jwt.go#L121-L157","documentation":"Sentry could not generate the random JWT ID (jti) claim. generateJwtID reads 16 bytes from crypto/rand.Reader and hex-encodes them; failure means the OS randomness source errored — the same entropy/RNG failure class as errors 702/705, but hit per-token instead of at startup.","triggerScenarios":"Every Generate call performs one rand.Read of 16 bytes; intermittent RNG failures on the host surface sporadically during token issuance rather than at boot.","commonSituations":"Entropy-starved nodes under load, sandboxed runtimes restricting getrandom, kernel RNG hardware faults; recurring in bursts if the node's CRNG is unhealthy.","solutions":["Treat as node health: move/reschedule the workload and check kernel RNG status","Verify container seccomp permits getrandom(2)","Retry the token request once — transient pool exhaustion can clear","Escalate to kernel/host diagnostics if failures cluster (dmesg, /proc/sys/kernel/random/entropy_avail)"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"token, err := issuer.Generate(ctx, req)\nif err != nil && strings.Contains(err.Error(), \"nonce\") {\n\ttime.Sleep(100 * time.Millisecond)\n\ttoken, err = issuer.Generate(ctx, req) // single retry\n}","preventionTips":["Run on hosts with a healthy entropy pool","Allow getrandom(2) in seccomp profiles","Alert on repeated nonce failures — they indicate node RNG problems"],"tags":["go","crypto-rand","jwt","dapr-sentry","entropy"],"backgroundTag":null,"analyzedSha":"74ad41702745709bb15fe2114ff693b8c59bc3cc","analyzedAt":"2026-08-16T04:22:26.543Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}