{"record":{"id":"67ecf230e30c934c","repo":"oauth2-proxy/oauth2-proxy","slug":"failed-to-decode-encryption-secret","errorCode":null,"errorMessage":"failed to decode encryption secret","messagePattern":"failed to decode encryption secret","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/sessions/persistence/ticket.go","lineNumber":114,"sourceCode":"// to decode the ticket secret part based on the encoding version, or lack of it.\nfunc decodeTicketSecret(ticketParts []string) ([]byte, error) {\n\tswitch {\n\tcase len(ticketParts) == 2:\n\t\t// old ticket encoding\n\t\tsecret, err := base64.RawURLEncoding.DecodeString(ticketParts[1])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to decode encryption secret: %v\", err)\n\t\t}\n\t\treturn secret, nil\n\tcase len(ticketParts) == 3 && ticketParts[0] == \"v2\":\n\t\t// new ticket encode\n\t\tsecret, err := base64.RawURLEncoding.DecodeString(ticketParts[2])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to decode encryption secret: %v\", err)\n\t\t}\n\t\treturn secret, nil\n\tdefault:\n\t\treturn nil, errors.New(\"failed to decode encryption secret\")\n\t}\n}\n\n// decodeTicket decodes an encoded ticket string\nfunc decodeTicket(encTicket string, cookieOpts *options.Cookie) (*ticket, error) {\n\tticketParts := strings.Split(encTicket, \".\")\n\tif len(ticketParts) != 2 && len(ticketParts) != 3 {\n\t\treturn nil, errors.New(\"failed to decode ticket\")\n\t}\n\tticketID, errTicketID := decodeTicketID(ticketParts)\n\tif errTicketID != nil {\n\t\treturn nil, fmt.Errorf(\"failed to decode ticket: %v\", errTicketID)\n\t}\n\tsecret, errSecret := decodeTicketSecret(ticketParts)\n\tif errSecret != nil {\n\t\treturn nil, fmt.Errorf(\"failed to decode ticket: %v\", errSecret)\n\t}\n\treturn &ticket{","sourceCodeStart":96,"sourceCodeEnd":132,"githubUrl":"https://github.com/oauth2-proxy/oauth2-proxy/blob/33c2eb92dea78204f7a18bc2dfdbccc220f39257/pkg/sessions/persistence/ticket.go#L96-L132","documentation":"Tickets carry the cookie secret used to encrypt the session as a base64url segment (ticketParts[2]). decodeTicketSecret decodes that segment; this error means the secret part is not valid base64 RawURL encoding, or the ticket encoding version is unrecognized so the default branch returns the bare error.","triggerScenarios":"decodeTicket is called with a 3-part ticket whose third segment fails base64.RawURLEncoding.DecodeString, or a ticket with an unknown version prefix falls into the default case.","commonSituations":"Cookie truncated or corrupted in transit/storage; ticket value altered by manual copy/paste; version mismatch between the oauth2-proxy that wrote and the one reading the ticket (e.g. upgrade/downgrade mixing v1 format with legacy 2-part format).","solutions":["Discard the corrupt ticket cookie and log in again to mint a new ticket.","Verify the full 3-part ticket is intact (two dots, all segments non-empty).","Check base64 segments are unpadded and URL-safe ('-'/'_' alphabet, no '=').","Align oauth2-proxy versions across deployments so the ticket encoding format matches.","If using Redis persistence, inspect the stored key for partial writes or encoding damage."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"func ticketSecretDecodable(v string) bool {\n    parts := strings.Split(v, \".\")\n    if len(parts) != 3 {\n        return false\n    }\n    _, err := base64.RawURLEncoding.DecodeString(parts[2])\n    return err == nil\n}","typeGuard":null,"tryCatchPattern":"t, err := decodeTicket(encTicket, cookieOpts)\nif err != nil {\n    log.Printf(\"invalid ticket (%v); clearing session\", err)\n    return nil, sessions.ErrInvalidSession\n}","preventionTips":["Treat ticket cookies as opaque; don't inspect or modify them between write and read.","Check storage backends (Redis/cookies) for truncation on write.","Pin oauth2-proxy versions during rolling upgrades to avoid format mismatches."],"tags":["base64","session","ticket","encryption"],"backgroundTag":"invalid-argument-format","analyzedSha":"33c2eb92dea78204f7a18bc2dfdbccc220f39257","analyzedAt":"2026-09-06T08:51:53.077Z","contentChangedAt":"2026-09-06T08:51:53.077Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}