{"record":{"id":"82141905e8c4294d","repo":"ory/hydra","slug":"global-secret-is-too-short","errorCode":null,"errorMessage":"global secret is too short","messagePattern":"global secret is too short","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"driver/config/provider_fosite.go","lineNumber":31,"sourceCode":"\t\"github.com/ory/hydra/v2/fosite\"\n\t\"github.com/ory/hydra/v2/fosite/token/jwt\"\n\t\"github.com/ory/hydra/v2/x\"\n)\n\nvar _ fosite.GlobalSecretProvider = (*DefaultProvider)(nil)\n\nfunc (p *DefaultProvider) GetGlobalSecret(ctx context.Context) ([]byte, error) {\n\tsecrets := p.getProvider(ctx).Strings(KeyGetSystemSecret)\n\n\tif len(secrets) == 0 {\n\t\tp.l.Error(\"The system secret is not configured. Please provide one in the configuration file or environment variables.\")\n\t\treturn nil, errors.New(\"global secret is not configured\")\n\t}\n\n\tsecret := secrets[0]\n\tif len(secret) < 16 {\n\t\tp.l.Errorf(\"System secret must be undefined or have at least 16 characters but only has %d characters.\", len(secret))\n\t\treturn nil, errors.New(\"global secret is too short\")\n\t}\n\n\treturn x.HashStringSecret(secret), nil\n}\n\nvar _ fosite.RotatedGlobalSecretsProvider = (*DefaultProvider)(nil)\n\nfunc (p *DefaultProvider) GetRotatedGlobalSecrets(ctx context.Context) ([][]byte, error) {\n\tsecrets := p.getProvider(ctx).Strings(KeyGetSystemSecret)\n\n\tif len(secrets) < 2 {\n\t\treturn nil, nil\n\t}\n\n\trotated := make([][]byte, len(secrets)-1)\n\tfor i, secret := range secrets[1:] {\n\t\trotated[i] = x.HashStringSecret(secret)\n\t}","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/driver/config/provider_fosite.go#L13-L49","documentation":"GetGlobalSecret rejects a configured system secret shorter than 16 characters, because short secrets are brute-forceable for the AES-GCM encryption Hydra applies to cookies and stored secrets. The value is then hashed into a byte secret via x.HashStringSecret.","triggerScenarios":"Calling GetGlobalSecret when secrets.system[0] (first configured value) has fewer than 16 characters, e.g. `secrets.system: [\"short\"]`.","commonSituations":"Developer set a memorable short password like `changeme`; a placeholder value left in production config; a trimmed or truncated environment variable.","solutions":["Replace the system secret with a value of at least 16 characters, e.g. `openssl rand -base64 32`","Update ORY_HYDRA_SECRETS_SYSTEM with the longer secret","Keep old secrets in the list as rotated values if existing encrypted data must remain readable"],"exampleFix":"// before\nsecrets:\n  system: [\"changeme\"]\n// after\nsecrets:\n  system:\n    - \"bG9uZy1yYW5kb20tc2VjcmV0LXZhbHVlIQ==\"","handlingStrategy":"validation","validationCode":"secret := os.Getenv(\"ORY_HYDRA_SECRETS_SYSTEM\")\nif len(secret) > 0 && len(secret) < 16 {\n    return errors.New(\"system secret must be at least 16 characters\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never hand-type secrets; always generate random 32-byte values","Add a pre-deploy config check enforcing min length","When rotating, append the new secret and keep the old one until data is re-encrypted"],"tags":["config","secrets","security","hydra"],"backgroundTag":"weak-secret-rejected","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}