node:crypto

The node:crypto module in Azion Runtime: hashes, HMAC signatures, secure random values, and access to the Web Crypto API, with examples and the supported APIs.

Last updated

View as Markdown Agent setup

The node:crypto module provides the Node.js cryptographic functions: hashing, HMAC signatures, encryption, decryption, and secure random values. In Node.js, the module wraps the OpenSSL hash, HMAC, cipher, decipher, sign, and verify functions. In Azion Runtime, the module is available through Node.js compatibility, so you can use it inside a function to sign requests, verify message integrity, or generate unique identifiers. Its subtle export, on the named import and on the default export, is the same object as globalThis.crypto.subtle, and the module also exports webcrypto.

Under azion dev, timingSafeEqual() and generateKeyPairSync() throw TypeError: (void 0) is not a function, and the build warns Import "timingSafeEqual" will always be undefined because there is no matching export in "internal-env-dev:crypto". Both functions work in a deployed function. Locally, Buffer.isBuffer() also returns false for the buffer that randomBytes() returns; deployed, it returns true.

Examples

Each example is a complete function that imports from node:crypto. The response below each example is the one a deployed function returns. Random values, such as UUIDs and tokens, differ on every request.

HMAC and UUID generation

This function signs a string with an HMAC key, prints the signature, and responds with a random UUID:

JavaScript
01/**
02 * An example of using the Node.js Crypto API in an Azion Function.
03 * Support:
04 * - Extended by library `crypto-browserify`
05 * - Implemented additional methods:
06 * - randomUUID (named export and default export)
07 * @module runtime-apis/nodejs/crypto/main
08 * @example
09 * // Build and run with the Azion CLI:
10 * azion build
11 * azion dev
12 */
13import { createHmac, randomUUID } from "node:crypto";
14
15/**
16 * Example of using the Node.js Crypto API
17 * @param {*} event
18 * @returns
19 */
20const main = async (event) => {
21 const hmac = createHmac("sha256", "a secret");
22 hmac.update("Azion Functions");
23 const hmacResult = hmac.digest("hex");
24 console.log(hmacResult);
25 // 86fec9e22ad82998c7007d637f61a5206e2b64ee2a8ac2ed12f1f359e3d14bc6
26
27 const uuid = randomUUID();
28 console.log(uuid);
29 // 9b942e1e-6ceb-49cd-9d75-e50c7852e950
30
31 return new Response(uuid, { status: 200 });
32};
33
34export default main;

The function responds with the UUID:

9b942e1e-6ceb-49cd-9d75-e50c7852e950

Hash generation with SHA-256

This function hashes a fixed string to check data integrity, and hashes the request URL to build a deterministic cache key:

JavaScript
01import { createHash } from "node:crypto";
02
03const main = async (event) => {
04 // Create a SHA-256 hash
05 const hash = createHash("sha256");
06 hash.update("Hello, Azion Runtime!");
07
08 const digest = hash.digest("hex");
09 console.log("SHA-256 hash:", digest);
10 // SHA-256 hash: 6183c5245446e11f9d5dc70b167bb7fb6d8f878576765db2106c18c24eba2970
11
12 // Hash request data for caching keys
13 // Note: event.request is available in Functions for Applications
14 const requestUrl = event.request?.url || "https://default.example.com";
15 const cacheKey = createHash("sha256")
16 .update(requestUrl)
17 .digest("hex");
18
19 console.log("Cache key:", cacheKey);
20
21 return new Response(JSON.stringify({ digest, cacheKey }), {
22 headers: { "Content-Type": "application/json" }
23 });
24};
25
26export default main;

The function responds with both hashes. The digest value is the same on every request; the cacheKey value depends on the request URL, so yours differs:

{"digest":"6183c5245446e11f9d5dc70b167bb7fb6d8f878576765db2106c18c24eba2970","cacheKey":"22d8de40ffcb2a09a030d3798d6821add8941a103b43c8e722d87b7ee59aa821"}

Random bytes generation

This function generates secure random values for a token, a session ID, and a nonce, and sets the nonce in a Content-Security-Policy header:

JavaScript
01import { randomBytes } from "node:crypto";
02import { Buffer } from "node:buffer";
03
04const main = async (event) => {
05 // Generate 32 random bytes
06 // Note: randomBytes returns a Buffer in Azion Runtime
07 const bytes = randomBytes(32);
08
09 // Ensure compatibility: convert to Buffer if needed
10 const buffer = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes);
11
12 const token = buffer.toString("hex");
13 console.log("Secure token:", token);
14
15 // Generate a shorter session ID
16 const sessionId = randomBytes(16).toString("base64url");
17 console.log("Session ID:", sessionId);
18
19 // Generate a nonce for CSP headers
20 const nonce = randomBytes(16).toString("base64");
21
22 // Show raw buffer output (common in Node.js)
23 console.log("Raw buffer:", bytes);
24
25 return new Response(JSON.stringify({ token, sessionId, nonce }), {
26 headers: {
27 "Content-Type": "application/json",
28 "Content-Security-Policy": `script-src 'nonce-${nonce}'`
29 }
30 });
31};
32
33export default main;

The function responds with the three values and sets Content-Security-Policy to script-src 'nonce-<nonce>', where <nonce> is the nonce value of the same response. The values differ on every request:

{"token":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","sessionId":"AAECAwQFBgcICQoLDA0ODw","nonce":"AAECAwQFBgcICQoLDA0ODw=="}

Web Crypto API integration

The crypto module also gives access to the Web Crypto API through crypto.subtle, which is the same object as globalThis.crypto.subtle. This function generates an AES key, exports it, and encrypts a string with it:

JavaScript
01import crypto from "node:crypto";
02
03const main = async (event) => {
04 // Access Web Crypto API
05 // Note: crypto.subtle === globalThis.crypto.subtle in Azion Runtime
06 const subtle = crypto.subtle;
07
08 // Generate an AES key for encryption
09 const key = await subtle.generateKey(
10 { name: "AES-GCM", length: 256 },
11 true,
12 ["encrypt", "decrypt"]
13 );
14
15 // Export the key for storage
16 const exportedKey = await subtle.exportKey("raw", key);
17 const keyBuffer = new Uint8Array(exportedKey);
18
19 console.log("Generated key length:", keyBuffer.length);
20 // Generated key length: 32
21
22 // Encrypt data
23 const iv = crypto.getRandomValues(new Uint8Array(12));
24 const encoder = new TextEncoder();
25 const data = encoder.encode("Sensitive data to encrypt");
26
27 const encrypted = await subtle.encrypt(
28 { name: "AES-GCM", iv },
29 key,
30 data
31 );
32
33 console.log("Encrypted data length:", encrypted.byteLength);
34 // Encrypted data length: 41
35
36 return new Response("Encryption complete", { status: 200 });
37};
38
39export default main;

The function responds with a confirmation, after it logs a key length of 32 bytes and an encrypted length of 41 bytes:

Encryption complete

Supported APIs

The table lists the status of each node:crypto API in Azion Runtime:

APIStatus
constants🟢 Supported
createHash()🟢 Supported
createHmac()🟢 Supported
getRandomValues()🟢 Supported
randomBytes()🟢 Supported
randomUUID()🟢 Supported
subtle🟢 Supported
webcrypto🟢 Supported
createCipher()🟡 Partially supported
createDecipher()🟡 Partially supported
createSign()🟡 Partially supported
createVerify()🟡 Partially supported

APIs marked 🟡 Partially supported have limited functionality compared to the full Node.js implementation. For encryption and signing, the Web Crypto API (crypto.subtle) is a more complete alternative. The module also exports functions the table does not list: createCipheriv() and createDecipheriv() encrypt and decrypt with aes-256-cbc, pbkdf2Sync() derives a key from a password, getHashes() is available, and timingSafeEqual() and generateKeyPairSync() work in a deployed function.

Node.js APIs

How each Node.js module behaves in Azion Runtime, with its support status.

SubtleCrypto

The Web Crypto methods that crypto.subtle exposes for encryption, signing, and key management.

Node.js crypto documentation

The parameters and return values of every node:crypto API, as Node.js documents them.

Web Crypto API on MDN

The standard behind crypto.subtle and crypto.getRandomValues().