crypto.randomUUID() not available on internal HTTP environment (non-secure context) #29534

Bug description

Description

We’re seeing inconsistent availability of the Web Crypto API depending on the environment. Specifically, crypto.randomUUID() works in some contexts but is undefined in others.

This appears to be tied to whether the page is running in a secure context.

Reproduction

Open app over HTTPS (or localhost):

crypto.randomUUID()

✅ Works as expected

Open app over internal HTTP hostname:

http://randomUrl.com
crypto.randomUUID()

❌ TypeError: crypto.randomUUID is not a function

Debug Info

running command in both windows

console.log(JSON.stringify({
  isSecureContext,
  hasCrypto: !!window.crypto,
  hasRandomUUID: !!window.crypto?.randomUUID,
  location: window.location.href
}));

Result on HTTPs/localhost environment(localhost):

{"isSecureContext":true,"hasCrypto":true,"hasRandomUUID":true,"location":"http://localhost:51212/"}

Result on internal HTTP hostname::
{"isSecureContext":false,"hasCrypto":true,"hasRandomUUID":false,"location":"http://***:8084/"}

crypto.randomUUID() should be available in all supported environments where UUID generation is required.

Actual Behaviour

crypto.randomUUID() is unavailable when the app is served over non-secure HTTP (non-localhost), causing runtime errors.

Root Cause

The Web Crypto API (including randomUUID) is only available in secure contexts:

✅ HTTPS
✅ http://localhost
❌ arbitrary HTTP origins (e.g. internal hostnames)

Severity

⚠️ Major: Breaks core functionality (e.g., migrations fail)

Reproduction

This is based off hosting prisma behind a

Expected vs. Actual Behavior

Actual Behaviour

crypto.randomUUID() is unavailable when the app is served over non-secure HTTP (non-localhost), causing runtime errors.

Root Cause

The Web Crypto API (including randomUUID) is only available in secure contexts:

✅ HTTPS
✅ http://localhost
❌ arbitrary HTTP origins (e.g. internal hostnames)

Expected behaviour

No use of crypto package in prisma studio

Frequency

Consistently reproducible

Does this occur in development or production?

Only in development (e.g., CLI tools, migrations, Prisma Studio)

Is this a regression?

Yes, this wasn't an issue in prisma 6

Workaround

Downgrade to prisma 6

Prisma Schema & Queries

// Add relevant schema.prisma snippet

// Add relevant Prisma Client query

Prisma Config

// Add your `prisma.config.ts`

Logs & Debug Info

// Debug logs here

Environment & Setup

• OS:
• Database:
• Node.js version:

Prisma Version

// Prisma version output