{"record":{"id":"7edad975ad2b7f02","repo":"kataras/iris","slug":"auth-configuration-cookie-block-and-cookie-hash","errorCode":null,"errorMessage":"auth: configuration: cookie block and cookie hash are required for security reasons when cookie is used","messagePattern":"auth: configuration: cookie block and cookie hash are required for security reasons when cookie is used","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"auth/configuration.go","lineNumber":73,"sourceCode":"\t\t// Hash is optional, it is used to authenticate cookie value using HMAC.\n\t\t// It is recommended to use a key with 32 or 64 bytes.\n\t\tHash string `json:\"hash\" yaml:\"Hash\" toml:\"Hash\" ini:\"hash\"`\n\t\t// Block is optional, used to encrypt cookie value.\n\t\t// The key length must correspond to the block size\n\t\t// of the encryption algorithm. For AES, used by default, valid lengths are\n\t\t// 16, 24, or 32 bytes to select AES-128, AES-192, or AES-256.\n\t\tBlock string `json:\"block\" yaml:\"Block\" toml:\"Block\" ini:\"block\"`\n\t}\n)\n\nfunc (c *Configuration) validate() (jwt.Keys, error) {\n\tif len(c.Headers) == 0 {\n\t\treturn nil, fmt.Errorf(\"auth: configuration: headers slice is empty\")\n\t}\n\n\tif c.Cookie.Name != \"\" {\n\t\tif c.Cookie.Hash == \"\" || c.Cookie.Block == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"auth: configuration: cookie block and cookie hash are required for security reasons when cookie is used\")\n\t\t}\n\t}\n\n\tkeys, err := c.Keys.Load()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"auth: configuration: %w\", err)\n\t}\n\n\tif _, ok := keys[KIDAccess]; !ok {\n\t\treturn nil, fmt.Errorf(\"auth: configuration: %s access token is missing from the configuration\", KIDAccess)\n\t}\n\n\t// Let's keep refresh optional.\n\t// if _, ok := keys[KIDRefresh]; !ok {\n\t// \treturn nil, fmt.Errorf(\"auth: configuration: %s refresh token is missing from the configuration\", KIDRefresh)\n\t// }\n\treturn keys, nil\n}","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/kataras/iris/blob/7bedaf55a0b64bbb2248a5845a2c60d81a30996a/auth/configuration.go#L55-L91","documentation":"When a cookie is configured (Cookie.Name is set), validate() requires both Cookie.Hash and Cookie.Block to be non-empty because cookie values are encrypted/authenticated for security. A half-configured cookie is rejected at startup.","triggerScenarios":"auth.New with Configuration.Cookie.Name non-empty while Cookie.Hash or Cookie.Block is an empty string.","commonSituations":"Setting only the cookie name when migrating from header auth to cookie auth; typos in TOML/YAML keys so Hash/Block never load; forgetting that cookies demand AES-GCM-style hash+block keys.","solutions":["Set both Cookie.Hash and Cookie.Block to strong key material (32-byte keys)","Remove the Cookie config entirely if cookies are not used","Check the config file keys actually load (case/indentation of yaml/toml/ini tags)","Generate keys with crypto/rand rather than hardcoding placeholders"],"exampleFix":"// before\nCookie: auth.Cookie{Name: \"session\"}\n// after\nCookie: auth.Cookie{Name: \"session\", Hash: hashKey(32), Block: blockKey(32)}","handlingStrategy":"validation","validationCode":"if cfg.Cookie.Name != \"\" && (cfg.Cookie.Hash == \"\" || cfg.Cookie.Block == \"\") {\n    return errors.New(\"cookie requires both hash and block keys\")\n}","typeGuard":"func cookieFullyConfigured(c auth.Cookie) bool {\n    return c.Name == \"\" || (c.Hash != \"\" && c.Block != \"\")\n}","tryCatchPattern":null,"preventionTips":["Generate 32-byte random hash and block keys with crypto/rand","If you set Cookie.Name, set Hash and Block in the same commit/config change","Verify YAML/TOML/INI key casing matches the struct tags so values actually load","Never ship placeholder or empty cookie keys to any environment"],"tags":["configuration","cookie","security","validation"],"backgroundTag":"missing-config-field","analyzedSha":"7bedaf55a0b64bbb2248a5845a2c60d81a30996a","analyzedAt":"2026-08-30T20:38:16.250Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}