{"record":{"id":"fb9cf81498d8bbda","repo":"OpenNHP/opennhp","slug":"fail-to-generate-session-id-w","errorCode":null,"errorMessage":"fail to generate session id: %w","messagePattern":"fail to generate session id: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"endpoints/server/kbs/auth/auth.go","lineNumber":40,"sourceCode":"\tNonce       string `json:\"nonce\"`\n\tExtraParams string `json:\"extra-params\"`\n}\n\nfunc generateNonce() (string, error) {\n\tb := make([]byte, 32)\n\t_, err := rand.Read(b)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\treturn base64.StdEncoding.EncodeToString(b), nil\n}\n\nfunc generateSecureSessionID() (string, error) {\n\trandomBytes := make([]byte, 32)\n\t_, err := rand.Read(randomBytes)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"fail to generate session id: %w\", err)\n\n\t}\n\n\treturn hex.EncodeToString(randomBytes), nil\n}\n\nfunc Auth(c *gin.Context) {\n\tvar req AuthRequest\n\n\tif err := c.ShouldBindJSON(&req); err != nil {\n\t\tc.JSON(http.StatusBadRequest, kbsError.InvalidRequest(err))\n\t\treturn\n\t}\n\n\tnonce, err := generateNonce()\n\tif err != nil {\n\t\tc.JSON(http.StatusInternalServerError, kbsError.NonceGenerationFailed(err))\n\t\treturn","sourceCodeStart":22,"sourceCodeEnd":58,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/server/kbs/auth/auth.go#L22-L58","documentation":"generateSecureSessionID reads 32 random bytes from crypto/rand to build the KBS session id. This error is returned when rand.Read fails, meaning the OS cryptographic random source is unavailable. The OS error is wrapped in 'fail to generate session id: %w'.","triggerScenarios":"Auth calls generateSecureSessionID and rand.Read returns an error — practically only when the OS entropy source is broken (e.g. /dev/urandom unavailable, getrandom syscall failure).","commonSituations":"Running in a container/sandbox with a broken /dev/urandom; extremely restricted seccomp profiles blocking getrandom; corrupted host OS; this is very rare in production Linux.","solutions":["Fix the host/container so /dev/urandom and the getrandom syscall are available","Inspect the wrapped error to identify the syscall failure (getrandom ENOSYS/EAGAIN)","Remove custom seccomp/AppArmor rules blocking getrandom(2)","If transient EAGAIN, retry rand.Read before failing the request"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"sessionID, err := generateSecureSessionID()\nif err != nil {\n\tlog.Errorf(\"session id generation failed: %v\", err)\n\thttp.Error(w, \"internal error\", http.StatusInternalServerError)\n\treturn\n}","preventionTips":["Monitor for repeated rand failures indicating host entropy problems","Avoid seccomp rules that block getrandom(2)","Keep /dev/urandom available in containers and chroots","Treat rand failure as fatal host-level condition, not a per-request retry in general"],"tags":["go","crypto-rand","entropy"],"backgroundTag":"invalid-argument-value","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}