{"record":{"id":"58dac1915119919b","repo":"ory/hydra","slug":"cookiex-cannot-encode-legacy-cookie","errorCode":null,"errorMessage":"cookiex: cannot encode legacy cookie","messagePattern":"cookiex: cannot encode legacy cookie","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/cookiex/legacy_securecookie.go","lineNumber":133,"sourceCode":"func (c *Codec[T]) sealLegacy(name string, value T) (string, error) {\n\tbuf, err := json.Marshal(value)\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"cookiex: cannot marshal cookie value\")\n\t}\n\tvar flat map[string]string\n\tif err := json.Unmarshal(buf, &flat); err != nil {\n\t\treturn \"\", errors.Wrap(err, \"cookiex: payload must be a flat JSON object with string values while legacy encode is enabled\")\n\t}\n\tif flat == nil {\n\t\treturn \"\", errors.New(\"cookiex: payload must be a flat JSON object with string values while legacy encode is enabled\")\n\t}\n\tvalues := make(map[any]any, len(flat))\n\tfor k, v := range flat {\n\t\tvalues[k] = v\n\t}\n\tencoded, err := securecookie.EncodeMulti(name, values, c.legacy.codecs[0])\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"cookiex: cannot encode legacy cookie\")\n\t}\n\treturn encoded, nil\n}\n","sourceCodeStart":115,"sourceCodeEnd":137,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/cookiex/legacy_securecookie.go#L115-L137","documentation":"sealLegacy delegates the actual encryption/signing to securecookie.EncodeMulti with the first legacy codec. If that low-level encoding fails (bad key, value too large, serialization error), the error is wrapped with this message.","triggerScenarios":"Calling Set with legacy encode enabled when securecookie.EncodeMulti fails: misconfigured/expired legacy codec keys, an empty codec list, or a value that securecookie cannot serialize (e.g. exceeding size or containing unsupported types).","commonSituations":"Rotating or deleting cookie hash/block keys so the legacy codec has invalid keys; cookie payload exceeding the 4KB browser limit after encoding; legacy codecs never initialized.","solutions":["Verify the legacy securecookie codec is initialized with valid hashKey and blockKey (correct lengths: 32/64 bytes hash, 16/24/32 bytes block).","Reduce cookie payload size so the encoded value fits within the ~4KB cookie limit.","Confirm c.legacy.codecs[0] exists before sealing; guard against an empty codec list."],"exampleFix":"// before\nlegacy.codecs = securecookie.Codecs{} // empty, no keys configured\n// after\nlegacy.codecs = securecookie.Codecs{securecookie.New([]byte(hashKey32bytes), []byte(blockKey32bytes))}","handlingStrategy":"try-catch","validationCode":"if len(c.legacy.codecs) == 0 {\n\treturn errors.New(\"cookiex: legacy codecs not initialized\")\n}","typeGuard":null,"tryCatchPattern":"encoded, err := cookiex.Set(w, name, value)\nif err != nil {\n\tvar e *errors.Error\n\tif stderrors.As(err, &e) && strings.Contains(e.Error(), \"cannot encode legacy cookie\") {\n\t\tlog.Printf(\"legacy cookie encode failed (check keys/payload size): %v\", err)\n\t\t// fall back to modern codec or return 500\n\t}\n}","preventionTips":["Validate hash/block key lengths at startup (hash 32 or 64 bytes; block 16/24/32).","Keep encoded cookie size under ~4KB; split or minimize payload.","Log securecookie's underlying error, not just the wrapper."],"tags":["cookiex","legacy-securecookie","encoding"],"backgroundTag":"securecookie-encode-failed","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}