# Session ID with PRNG

**URL:** <https://discourse.nodered.org/t/session-id-with-prng/32747>\
**Category:** General\
**Created:** [11 September 2020 12:35 UTC](https://discourse.nodered.org/t/session-id-with-prng/32747 "2020-09-11T12:35:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![JFP](https://avatars.discourse-cdn.com/v4/letter/j/ed8c4c/32.png) [@JFP](https://discourse.nodered.org/u/JFP)\
**Post date:** [11 September 2020 12:35 UTC](https://discourse.nodered.org/t/session-id-with-prng/32747/1 "2020-09-11T12:35:30Z")

</div>

Hello there,

we want to use Node-Red, but our security-team requests, that the SessionID of a web-applications for every user has to be unpredictable randomised (PRNG) with at least 128bit entropy.

I tried to search for that without any clear answer.

So my question is, does Node-Red fits these requirements and is documented anywhere or can it be configured like this?  
Or ist this realated to OS?

Thank you very much for your help!

Have a nice weekend  
Jan-Frederik

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [11 September 2020 12:51 UTC](https://discourse.nodered.org/t/session-id-with-prng/32747/2 "2020-09-11T12:51:47Z")

</div>

Are you referring to the login token used to access the Node-RED editor? Or is this about the application you'd like to create using Node-RED?

If this is regarding the session token for the editor, you can see the code used to generate the token here: [https://github.com/node-red/node-red/blob/master/packages/node\_modules/@node-red/editor-api/lib/auth/tokens.js#L17](https://github.com/node-red/node-red/blob/master/packages/node_modules/@node-red/editor-api/lib/auth/tokens.js#L17)

The tokens are generated as 128 character random hex strings using node's built-in Math.random function, which does have 128bit entropy from the v8 engine - [https://v8.dev/blog/math-random](https://v8.dev/blog/math-random)

Whether that is sufficient for your needs, I can't say.

Now I look at it again, there are probably better alternatives to Math.random built into node.js that we ought to move over to. Something for the next release.

---

<div class="post-metadata">

**Author:** ![JFP](https://avatars.discourse-cdn.com/v4/letter/j/ed8c4c/32.png) [@JFP](https://discourse.nodered.org/u/JFP)\
**Post date:** [11 September 2020 13:04 UTC](https://discourse.nodered.org/t/session-id-with-prng/32747/3 "2020-09-11T13:04:59Z")

</div>

Hi Knolleary,

thanks for your fast response!  
I thought about the session token for the editor itself.  
So your answer is perfect for me and if you will implement better solutions you know, this would be very nice, of course.

Is the SessionID different for applications created with Node-Red?

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [11 September 2020 13:12 UTC](https://discourse.nodered.org/t/session-id-with-prng/32747/4 "2020-09-11T13:12:21Z")

</div>

> [@JFP](#):
>
> if you will implement better solutions you know, this would be very nice, of course.

You caught me at the right time with this question - just pushed a commit that moves over to node's `crypto.randomBytes` function for all of our token/session generation. Will be in the next release.

> <https://github.com/node-red/node-red/commit/70b6674f44174fdd03fbf3c6d2c634b666842119>

(By "right time" I mean: "I have lots I should be doing, but finding plenty of distractions to keep me busy")

> [@JFP](#):
>
> Is the SessionID different for applications created with Node-Red?

Yes - because the built-in HTTP nodes do not have any session handling built into them. It is up to the Application Developer to create whatever session handling they need.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [10 November 2020 13:12 UTC](https://discourse.nodered.org/t/session-id-with-prng/32747/5 "2020-11-10T13:12:25Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.