{"record":{"id":"4e51a7d56fb04e5c","repo":"ory/hydra","slug":"cookiex-cannot-derive-key","errorCode":null,"errorMessage":"cookiex: cannot derive key","messagePattern":"cookiex: cannot derive key","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/cookiex/cookiex.go","lineNumber":104,"sourceCode":"\t}\n\tif len(secrets) == 0 {\n\t\treturn nil, errors.New(\"cookiex: at least one secret is required\")\n\t}\n\tcfg := config{maxAge: defaultMaxAge}\n\tfor _, opt := range opts {\n\t\topt(&cfg)\n\t}\n\tif cfg.maxAge < 0 {\n\t\treturn nil, errors.New(\"cookiex: max age must not be negative\")\n\t}\n\tif cfg.legacyEncode && len(cfg.legacyKeyPairs) == 0 {\n\t\treturn nil, errors.New(\"cookiex: legacy encode requires legacy key pairs\")\n\t}\n\tkeys := make([][32]byte, len(secrets))\n\tfor i, secret := range secrets {\n\t\tkey, err := hkdf.Key(sha256.New, secret, nil, kdfInfo, 32)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"cookiex: cannot derive key\")\n\t\t}\n\t\tkeys[i] = [32]byte(key)\n\t}\n\treturn &Codec[T]{\n\t\tpurpose: purpose,\n\t\tkeys:    keys,\n\t\tmaxAge:  cfg.maxAge,\n\t\tlegacy:  newLegacyState(cfg, cfg.maxAge),\n\t\tnow:     time.Now,\n\t}, nil\n}\n\n// envelope wraps the JSON payload with the seal time so decoding can enforce\n// the max age.\ntype envelope struct {\n\tIssuedAt int64           `json:\"iat\"`\n\tValues   json.RawMessage `json:\"v\"`\n}","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/cookiex/cookiex.go#L86-L122","documentation":"Returned by cookiex.New when HKDF key derivation over one of the provided secrets fails (wrapped with \"cookiex: cannot derive key\"). Derivation with SHA-256 effectively only fails if the system PRNG/IO is broken; per-secret input is arbitrary bytes, so this is an environmental or crypto-library failure, not bad user input.","triggerScenarios":"Thrown at oryx/cookiex/cookiex.go:104 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the wrapped underlying error for the actual HKDF failure cause","Verify the secrets slice contains usable byte strings and is not corrupted","Treat failure as fatal at startup; cookie keys cannot be provisioned without derivation"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}