{"record":{"id":"4de09cd22984eb7e","repo":"ory/kratos","slug":"you-must-provide-secrets-pagination-for-fips-com","errorCode":null,"errorMessage":"you must provide `secrets.pagination` for FIPS compliance","messagePattern":"you must provide `secrets\\.pagination` for FIPS compliance","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"driver/config/config.go","lineNumber":435,"sourceCode":"\t\t}),\n\t}, opts...)\n\n\tp, err := configx.New(ctx, embedx.ConfigSchema, opts...)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tl.UseConfig(p)\n\n\tc = NewCustom(l, p, stdOutOrErr, ctxer)\n\n\tif !p.SkipValidation() {\n\t\tif err := c.validateIdentitySchemas(ctx); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif fips140.Enabled() {\n\t\t\tif len(p.Strings(ViperKeySecretsPagination)) == 0 {\n\t\t\t\treturn nil, errors.New(\"you must provide `secrets.pagination` for FIPS compliance\")\n\t\t\t}\n\t\t\tif len(p.Strings(ViperKeySecretsCipher)) == 0 {\n\t\t\t\treturn nil, errors.New(\"you must provide `secrets.cipher` for FIPS compliance\")\n\t\t\t}\n\t\t\tif len(p.Strings(ViperKeySecretsCookie)) == 0 {\n\t\t\t\treturn nil, errors.New(\"you must provide `secrets.cookie` for FIPS compliance\")\n\t\t\t}\n\t\t\tif len(p.Strings(ViperKeySecretsDefault)) == 0 {\n\t\t\t\treturn nil, errors.New(\"you must provide `secrets.default` for FIPS compliance\")\n\t\t\t}\n\t\t}\n\t}\n\n\treturn c, nil\n}\n\nfunc NewCustom(l *logrusx.Logger, p *configx.Provider, stdOutOrErr io.Writer, ctxt contextx.Contextualizer) *Config {\n\tl.UseConfig(p)","sourceCodeStart":417,"sourceCodeEnd":453,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/driver/config/config.go#L417-L453","documentation":"When FIPS 140 mode is enabled (fips140.Enabled()), the Ory config validation requires explicitly configured pagination secrets, because FIPS-compliant random generation cannot safely derive/default these secrets. If the `secrets.pagination` config key has no values, config validation fails.","triggerScenarios":"Running the server (driver.New with validation) with FIPS 140 mode enabled (e.g. GODEBUG=fips140=on or equivalent flag) and no `secrets.pagination` array set in config/env.","commonSituations":"Migrating a deployment to a FIPS-hardened build/image where secrets that used to be auto-generated must now be provided; copying a config from a non-FIPS environment.","solutions":["Add `secrets.pagination` to your config: e.g. `secrets: { pagination: [\"<32+char-random-string>\"] }`","Or set the corresponding env/key in your secret manager so it appears in config","Generate secrets with a FIPS-approved RNG (e.g. `openssl rand` with FIPS provider)","Review the other FIPS-required keys (secrets.cipher, secrets.cookie, secrets.default) and set them all at once"],"exampleFix":"// before (config.yml)\nsecrets: {}\n// after (config.yml)\nsecrets:\n  pagination:\n    - \"a-very-long-random-pagination-secret-value\"\n  cipher:\n    - \"a-very-long-random-cipher-secret\"\n  cookie:\n    - \"a-very-long-random-cookie-secret\"\n  default:\n    - \"a-very-long-random-default-secret\"","handlingStrategy":"validation","validationCode":"if fipsEnabled && len(cfg.Secrets.Pagination) == 0 {\n  return errors.New(\"secrets.pagination is required in FIPS mode\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Maintain a single FIPS-ready config template containing all four secret keys","Generate and rotate secrets via your secret manager pipeline before enabling FIPS","Run config validation in CI against the same validator before deploying"],"tags":["config","fips","security","validation"],"backgroundTag":"missing-required-config-field","analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}