Pretty much immediately I found a bug in his session generation:

https://github.com/davidmoreno/onion/blob/master/src/onion/s...

The fact that in amongst the doc comment is "not really safe" should probably be a big red flag.

Then this happens:

https://github.com/davidmoreno/onion/blob/master/src/onion/s...

Not to mention that here:

https://github.com/davidmoreno/onion/blob/master/src/onion/h...

It'll just let you in if you can guess someone else's session.

Seriously. Systems ship with crypto API's. And uuid libraries.

USE THEM, FFS.