{"record":{"id":"764fa48f23e9876d","repo":"oauth2-proxy/oauth2-proxy","slug":"could-not-read-cookie-secret-file","errorCode":null,"errorMessage":"could not read cookie secret file","messagePattern":"could not read cookie secret file","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/apis/options/cookie.go","lineNumber":79,"sourceCode":"\t\tHTTPOnly:            true,\n\t\tSameSite:            \"\",\n\t\tCSRFPerRequest:      false,\n\t\tCSRFPerRequestLimit: 0,\n\t\tCSRFExpire:          time.Duration(15) * time.Minute,\n\t\tCSRFSameSite:        \"\",\n\t}\n}\n\n// GetSecret returns the cookie secret, reading from file if SecretFile is set\nfunc (c *Cookie) GetSecret() (secret string, err error) {\n\tif c.Secret != \"\" || c.SecretFile == \"\" {\n\t\treturn c.Secret, nil\n\t}\n\n\tfileSecret, err := os.ReadFile(c.SecretFile)\n\tif err != nil {\n\t\tlogger.Errorf(\"error reading cookie secret file %s: %s\", c.SecretFile, err)\n\t\treturn \"\", errors.New(\"could not read cookie secret file\")\n\t}\n\n\treturn string(fileSecret), nil\n}\n","sourceCodeStart":61,"sourceCodeEnd":84,"githubUrl":"https://github.com/oauth2-proxy/oauth2-proxy/blob/33c2eb92dea78204f7a18bc2dfdbccc220f39257/pkg/apis/options/cookie.go#L61-L84","documentation":"GetSecret in pkg/apis/options/cookie.go returns the OAuth2 proxy cookie secret either from an inline value or by reading the file at SecretFile. When the secret is not set inline and os.ReadFile of SecretFile fails, it logs and returns this error. The cookie secret is required to encrypt/sign session cookies, so startup or session handling fails.","triggerScenarios":"CookieOptions has empty Secret and a non-empty SecretFile that cannot be read: file missing, wrong path, or unreadable permissions, e.g. Load()/makeCipher()/decodeCSRFCookie() calling GetSecret().","commonSituations":"Kubernetes secret mounted at a different path than configured; file deleted after rotation; running the proxy as a non-root user without read access; typo in --cookie-secret-file flag.","solutions":["Verify the path in --cookie-secret-file / SecretFile exists and is readable by the proxy process user","Set the secret inline via cookie secret instead of a file, or fix the mount path in your deployment manifest","Check file permissions (chmod/chown) and that the mounted secret volume is present","Regenerate the secret file if it was removed, and reconfigure all replicas to use the same secret"],"exampleFix":"// before\ncookie:\n  secretFile: \"/etc/secrets/cookie_secret\"\n// after\n# ensure the file exists and is mounted:\n# kubectl create secret generic cookie-secret --from-file=cookie_secret=./cookie_secret\ncookie:\n  secretFile: \"/etc/secrets/cookie_secret/cookie_secret\"","handlingStrategy":"validation","validationCode":"if opts.SecretFile != \"\" {\n\tif _, err := os.Stat(opts.SecretFile); err != nil {\n\t\treturn fmt.Errorf(\"cookie secret file %s unavailable: %w\", opts.SecretFile, err)\n\t}\n}","typeGuard":null,"tryCatchPattern":"secret, err := opts.GetSecret()\nif err != nil {\n\tif err.Error() == \"could not read cookie secret file\" {\n\t\t// fall back to a mounted default or fail fast at startup\n\t}\n\treturn err\n}","preventionTips":["Probe SecretFile existence/readability at process startup before serving traffic","Use a mounted Kubernetes secret with a stable mountPath and subPath","Run the proxy under a user with read access to the secrets directory","Set the secret inline as a fallback when file-based secrets are optional"],"tags":["go","config","file-read","secrets"],"backgroundTag":"file-read-failed","analyzedSha":"33c2eb92dea78204f7a18bc2dfdbccc220f39257","analyzedAt":"2026-09-06T08:51:53.077Z","contentChangedAt":"2026-09-06T08:51:53.077Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}