What causes "Failed to generate random CSRF token!" in phpmyadmin/phpmyadmin?

Ensure /dev/urandom (or /dev/random) exists and is readable by PHP

phpmyadmin/phpmyadmin · critical · SessionHandlerException

Failed to generate random CSRF token!

Error message

Failed to generate random CSRF token!

What it means

phpMyAdmin's session bootstrap needs a CSRF token in $_SESSION[' PMA_token ']. generateToken verifies the token after generation; if it is still empty (random_bytes/openssl_random_pseudo_bytes failed or the value never landed in the session), it throws SessionHandlerException.

Solutions

Ensure /dev/urandom (or /dev/random) exists and is readable by PHP
Enable the OpenSSL extension (or upgrade PHP >= 7 where random_bytes is built-in)
Check php.ini for open_basedir/disabled_functions blocking random sources
Fix session storage so $_SESSION writes persist, then retry

Example fix

// before (container without /dev/urandom)
Fatal: SessionHandlerException: Failed to generate random CSRF token!
// after (Dockerfile)
RUN mknod /dev/random c 1 8 && mknod /dev/urandom c 1 9 && chmod 666 /dev/random /dev/urandom
; php.ini: extension=openssl

Defensive patterns

Strategy: validation

Validate before calling

if (!is_readable('/dev/urandom') && !extension_loaded('openssl')) {
    die('PHP needs a secure RNG: enable openssl or provide /dev/urandom');
}
try { $probe = random_bytes(16); } catch (\Random\RandomException $e) { die('RNG unavailable'); }

Try / catch

try {
    Session::setUp($config, $request);
} catch (SessionHandlerException $e) {
    error_log('Session/RNG broken: ' . $e->getMessage());
    http_response_code(500);
    exit('Sessions are unavailable; fix PHP RNG/session configuration.');
}

Prevention

Verify /dev/urandom exists in containers; create the device node if needed
Enable the OpenSSL PHP extension in all environments
Avoid open_basedir/disabled_functions rules blocking random sources
Smoke-test session + token generation in CI matching production image

When it happens

Trigger: generateToken (from secure or setUp) runs, getToken() returns '' because no cryptographically secure RNG is available (missing /dev/random, disabled openssl extension, entropy exhaustion).

Common situations: Containers/chrooted environments lacking /dev/urandom; openssl or mbstring PHP extension missing; open_basedir blocking /dev/urandom; extremely low entropy systems.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of phpmyadmin/phpmyadmin@70d713dc39 (2026-09-13). Data as JSON: /api/errors/da2dc62e864f8438. Report an issue: GitHub.

Appendix: source

Thrown at src/Session.php:57

     */
    private static function generateToken(): void
    {
        /**
         * Token which is used for authenticating access queries.
         * (we use "space PMA_token space" to prevent overwriting)
         */
        $_SESSION[' PMA_token '] = Util::generateRandom(16, true);
        $_SESSION[' HMAC_secret '] = Util::generateRandom(16);

        /**
         * Check if token is properly generated (the generation can fail, for example
         * due to missing /dev/random for openssl).
         */
        if (self::getToken() !== '') {
            return;
        }

        throw new SessionHandlerException('Failed to generate random CSRF token!');
    }

    public static function getToken(): string
    {
        if (isset($_SESSION[' PMA_token ']) && is_string($_SESSION[' PMA_token '])) {
            return $_SESSION[' PMA_token '];
        }

        return '';
    }

    /**
     * tries to secure session from hijacking and fixation
     * should be called before login and after successful login
     * (only required if sensitive information stored in session)
     *
     * @throws SessionHandlerException
     */

View on GitHub (pinned to 70d713dc39)