{"record":{"id":"3643cdb6228420b9","repo":"apereo/cas","slug":"interrupt-webflow-cookie-encryption-signing-is-not","errorCode":null,"errorMessage":"Interrupt webflow cookie encryption/signing is not enabled explicitly in the configuration for cookie [{}], yet signing/encryption keys are defined for operations. CAS will proceed to enable the cookie encryption/signing functionality.","messagePattern":"Interrupt webflow cookie encryption/signing is not enabled explicitly in the configuration for cookie \\[(.+?)\\], yet signing/encryption keys are defined for operations\\. CAS will proceed to enable the cookie encryption/signing functionality\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"info","filePath":"support/cas-server-support-interrupt-core/src/main/java/org/apereo/cas/config/CasInterruptAutoConfiguration.java","lineNumber":74,"sourceCode":"@Slf4j\n@ConditionalOnFeatureEnabled(feature = CasFeatureModule.FeatureCatalog.InterruptNotifications)\n@AutoConfiguration\npublic class CasInterruptAutoConfiguration {\n\n    @Configuration(value = \"CasInterruptTrackingConfiguration\", proxyBeanMethods = false)\n    @EnableConfigurationProperties(CasConfigurationProperties.class)\n    static class CasInterruptTrackingConfiguration {\n        @Bean\n        @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT)\n        @ConditionalOnMissingBean(name = \"interruptCookieCipherExecutor\")\n        public CipherExecutor interruptCookieCipherExecutor(\n            final ConfigurableApplicationContext applicationContext,\n            final CasConfigurationProperties casProperties) {\n            val props = casProperties.getInterrupt().getCookie();\n            var enabled = props.getCrypto().isEnabled();\n            if (!enabled && StringUtils.isNotBlank(props.getCrypto().getEncryption().getKey())\n                && StringUtils.isNotBlank(props.getCrypto().getSigning().getKey())) {\n                LOGGER.warn(\"Interrupt webflow cookie encryption/signing is not enabled explicitly in the configuration for cookie [{}], yet signing/encryption keys \"\n                    + \"are defined for operations. CAS will proceed to enable the cookie encryption/signing functionality.\", props.getName());\n                enabled = true;\n            }\n\n            if (enabled) {\n                return CipherExecutorUtils.newStringCipherExecutor(props.getCrypto(), InterruptTrackingCookieCipherExecutor.class);\n            }\n            LOGGER.info(\"Interrupt webflow cookie encryption/signing is turned off and MAY NOT be safe in a production environment. \"\n                + \"Consider using other choices to handle encryption, signing and verification of metadata artifacts\");\n            return CipherExecutor.noOp();\n        }\n\n        @ConditionalOnMissingBean(name = \"interruptCookieValueManager\")\n        @Bean\n        @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT)\n        public CookieValueManager interruptCookieValueManager(\n            @Qualifier(TenantExtractor.BEAN_NAME)\n            final TenantExtractor tenantExtractor,","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-interrupt-core/src/main/java/org/apereo/cas/config/CasInterruptAutoConfiguration.java#L56-L92","documentation":"The interrupt webflow cookie cipher executor bean checks whether interrupt cookie crypto is explicitly enabled. When crypto is disabled but both signing and encryption keys are configured, CAS warns 'Interrupt webflow cookie encryption/signing is not enabled...' and force-enables the cipher anyway, inferring intent from the presence of keys.","triggerScenarios":"Configuring cas.interrupt.cookie.crypto.encryption.key and cas.interrupt.cookie.crypto.signing.key without setting cas.interrupt.cookie.crypto.enabled=true; the bean creation (interruptCookieCipherExecutor) then logs the warning and enables crypto implicitly.","commonSituations":"Operators copy cookie crypto settings from other CAS cookies but forget the explicit enabled flag; or leave stale keys behind while intending to disable cookie crypto, causing unexpected encryption behavior.","solutions":["Set cas.interrupt.cookie.crypto.enabled=true if you intend the keys to be used","Remove the signing/encryption keys from configuration if you intend cookie crypto to stay off","Restart/reload the CAS context after adjusting properties so the bean re-initializes"],"exampleFix":"// before\ncas.interrupt.cookie.crypto.encryption.key=...\ncas.interrupt.cookie.crypto.signing.key=...\n// after\ncas.interrupt.cookie.crypto.enabled=true\ncas.interrupt.cookie.crypto.encryption.key=...\ncas.interrupt.cookie.crypto.signing.key=...","handlingStrategy":"validation","validationCode":"boolean keysPresent = StringUtils.isNotBlank(props.getCrypto().getEncryption().getKey())\n    && StringUtils.isNotBlank(props.getCrypto().getSigning().getKey());\nif (keysPresent != props.getCrypto().isEnabled()) {\n    LOGGER.warn(\"interrupt cookie crypto enabled flag mismatch\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set crypto.enabled explicitly when supplying keys","Remove unused keys from configuration","Keep cookie crypto config consistent across all CAS cookies","Lint config for enabled-vs-keys mismatches at deploy time"],"tags":["configuration","crypto","cookie","interrupt"],"backgroundTag":"conflicting-config-options","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}