Interrupt webflow cookie encryption/signing is not enabled…

Error message

Interrupt webflow cookie encryption/signing is not enabled explicitly in the configuration for cookie [{}], yet signing/encryption keys are defined for operations. CAS will proceed to enable the cookie encryption/signing functionality.

What it means

The interrupt webflow cookie cipher executor bean checks whether interrupt cookie crypto is explicitly enabled. When crypto is disabled but both signing and encryption keys are configured, CAS warns 'Interrupt webflow cookie encryption/signing is not enabled...' and force-enables the cipher anyway, inferring intent from the presence of keys.

Solutions

Set cas.interrupt.cookie.crypto.enabled=true if you intend the keys to be used
Remove the signing/encryption keys from configuration if you intend cookie crypto to stay off
Restart/reload the CAS context after adjusting properties so the bean re-initializes

Example fix

// before
cas.interrupt.cookie.crypto.encryption.key=...
cas.interrupt.cookie.crypto.signing.key=...
// after
cas.interrupt.cookie.crypto.enabled=true
cas.interrupt.cookie.crypto.encryption.key=...
cas.interrupt.cookie.crypto.signing.key=...

Defensive patterns

Strategy: validation

Validate before calling

boolean keysPresent = StringUtils.isNotBlank(props.getCrypto().getEncryption().getKey())
    && StringUtils.isNotBlank(props.getCrypto().getSigning().getKey());
if (keysPresent != props.getCrypto().isEnabled()) {
    LOGGER.warn("interrupt cookie crypto enabled flag mismatch");
}

Prevention

Always set crypto.enabled explicitly when supplying keys
Remove unused keys from configuration
Keep cookie crypto config consistent across all CAS cookies
Lint config for enabled-vs-keys mismatches at deploy time

When it happens

Trigger: Configuring cas.interrupt.cookie.crypto.encryption.key and cas.interrupt.cookie.crypto.signing.key without setting cas.interrupt.cookie.crypto.enabled=true; the bean creation (interruptCookieCipherExecutor) then logs the warning and enables crypto implicitly.

Common situations: Operators copy cookie crypto settings from other CAS cookies but forget the explicit enabled flag; or leave stale keys behind while intending to disable cookie crypto, causing unexpected encryption behavior.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/3643cdb6228420b9. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-interrupt-core/src/main/java/org/apereo/cas/config/CasInterruptAutoConfiguration.java:74

@Slf4j
@ConditionalOnFeatureEnabled(feature = CasFeatureModule.FeatureCatalog.InterruptNotifications)
@AutoConfiguration
public class CasInterruptAutoConfiguration {

    @Configuration(value = "CasInterruptTrackingConfiguration", proxyBeanMethods = false)
    @EnableConfigurationProperties(CasConfigurationProperties.class)
    static class CasInterruptTrackingConfiguration {
        @Bean
        @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT)
        @ConditionalOnMissingBean(name = "interruptCookieCipherExecutor")
        public CipherExecutor interruptCookieCipherExecutor(
            final ConfigurableApplicationContext applicationContext,
            final CasConfigurationProperties casProperties) {
            val props = casProperties.getInterrupt().getCookie();
            var enabled = props.getCrypto().isEnabled();
            if (!enabled && StringUtils.isNotBlank(props.getCrypto().getEncryption().getKey())
                && StringUtils.isNotBlank(props.getCrypto().getSigning().getKey())) {
                LOGGER.warn("Interrupt webflow cookie encryption/signing is not enabled explicitly in the configuration for cookie [{}], yet signing/encryption keys "
                    + "are defined for operations. CAS will proceed to enable the cookie encryption/signing functionality.", props.getName());
                enabled = true;
            }

            if (enabled) {
                return CipherExecutorUtils.newStringCipherExecutor(props.getCrypto(), InterruptTrackingCookieCipherExecutor.class);
            }
            LOGGER.info("Interrupt webflow cookie encryption/signing is turned off and MAY NOT be safe in a production environment. "
                + "Consider using other choices to handle encryption, signing and verification of metadata artifacts");
            return CipherExecutor.noOp();
        }

        @ConditionalOnMissingBean(name = "interruptCookieValueManager")
        @Bean
        @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT)
        public CookieValueManager interruptCookieValueManager(
            @Qualifier(TenantExtractor.BEAN_NAME)
            final TenantExtractor tenantExtractor,

View on GitHub (pinned to e7288fc434)