{"record":{"id":"1163d18d02eef9e6","repo":"phalcon/cphalcon","slug":"the-cookie-s-key-should-be-at-least-32-characters","errorCode":null,"errorMessage":"The cookie's key should be at least 32 characters long. Current length is {length}.","messagePattern":"The cookie's key should be at least 32 characters long\\. Current length is (.+?)\\.","errorType":"exception","errorClass":"Phalcon\\Http\\Cookie\\Exceptions\\CookieKeyTooShort","httpStatus":null,"severity":"error","filePath":"phalcon/Http/Cookie.zep","lineNumber":535,"sourceCode":"    {\n        let this->useEncryption = useEncryption;\n\n        return this;\n    }\n\n    /**\n     * Assert the cookie's key is enough long.\n     *\n     * @throws \\Phalcon\\Http\\Cookie\\Exception\n     */\n    protected function assertSignKeyIsLongEnough( string signKey) -> void\n    {\n        var length;\n\n        let length = mb_strlen(signKey);\n\n        if unlikely length < 32 {\n            throw new CookieKeyTooShort(length);\n        }\n    }\n\n    /**\n     * Check if the cookie is restored and restore it if not\n     */\n    private function checkRestored() -> void\n    {\n        if (true !== this->isRestored) {\n            this->restore();\n        }\n    }\n\n    /**\n     * @phpstan-return http_setcookie_options\n     */\n    private function getCookieOptions(int expiresDefault) -> array\n    {","sourceCodeStart":517,"sourceCodeEnd":553,"githubUrl":"https://github.com/phalcon/cphalcon/blob/b7419de9cd0a8a3f48441ead84c9f8415d463e25/phalcon/Http/Cookie.zep#L517-L553","documentation":"Http\\Cookie::assertSignKeyIsLongEnough() - reached via setSignKey() and the cookie constructor - rejects signing keys shorter than 32 characters (mb_strlen). The sign key is passed to crypt->encryptBase64($value, $signKey) to sign cookie values; Phalcon enforces a minimum length as a security margin and throws CookieKeyTooShort for anything weaker.","triggerScenarios":"Calling $cookie->setSignKey('shortkey') or constructing a Cookie with a sign key argument whose mb_strlen() is under 32 characters.","commonSituations":"Migrating from Phalcon 3/4 where no minimum length was enforced; reusing a legacy 16-character application secret as the cookie sign key; keys produced by weak generation methods (short hex, truncated hashes).","solutions":["Generate and use a key of at least 32 characters, e.g. bin2hex(random_bytes(32)) (64 hex chars), stored in env/config","Rotate the existing cookie sign key to a long random value and update the service/config that supplies it","Pass null (or omit) the sign key if signing is not required - encryption then relies on the crypt service key"],"exampleFix":"// before\n$cookie->setSignKey('4c1f9d32'); // 8 chars -> throws\n\n// after\n$cookie->setSignKey(bin2hex(random_bytes(32))); // 64 chars, >= 32 required","handlingStrategy":"validation","validationCode":"$key = (string) (getenv('COOKIE_SIGN_KEY') ?: '');\nif (mb_strlen($key) < 32) {\n    throw new \\InvalidArgumentException('Cookie sign key must be >= 32 chars. Generate with bin2hex(random_bytes(32))');\n}\n$cookie->setSignKey($key);","typeGuard":null,"tryCatchPattern":"try { $cookie->setSignKey($key); } catch (\\Phalcon\\Http\\Cookie\\Exceptions\\CookieKeyTooShort $e) { // regenerate instead of padding\n    $key = bin2hex(random_bytes(32));\n    // persist new key, then retry once\n}","preventionTips":["Generate keys with bin2hex(random_bytes(32)) or equivalent CSPRNG output","Validate key length at application boot, not at cookie send time","Never pad a short legacy key - rotate to a properly generated one"],"tags":["php","phalcon","cookies","signing","key-length","security"],"backgroundTag":"encryption-key-too-short","analyzedSha":"b7419de9cd0a8a3f48441ead84c9f8415d463e25","analyzedAt":"2026-08-21T06:21:18.811Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}