{"record":{"id":"8535f5bb293846e7","repo":"quarkusio/quarkus","slug":"io-undertow-server-session-securerandomsessionidge","errorCode":null,"errorMessage":"io.undertow.server.session.SecureRandomSessionIdGenerator must be exactly 64 characters long","messagePattern":"io\\.undertow\\.server\\.session\\.SecureRandomSessionIdGenerator must be exactly 64 characters long","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/undertow/runtime/src/main/java/io/quarkus/undertow/runtime/UndertowDeploymentRecorder.java","lineNumber":830,"sourceCode":"\n    /**\n     * we can't have SecureRandom in the native image heap, so we need to lazy init\n     */\n    private static class QuarkusSessionIdGenerator implements SessionIdGenerator {\n\n        private volatile SecureRandom random;\n\n        private volatile int length = 30;\n\n        private static final char[] SESSION_ID_ALPHABET;\n\n        private static final String ALPHABET_PROPERTY = \"io.undertow.server.session.SecureRandomSessionIdGenerator.ALPHABET\";\n\n        static {\n            String alphabet = System.getProperty(ALPHABET_PROPERTY,\n                    \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\");\n            if (alphabet.length() != 64) {\n                throw new RuntimeException(\n                        \"io.undertow.server.session.SecureRandomSessionIdGenerator must be exactly 64 characters long\");\n            }\n            SESSION_ID_ALPHABET = alphabet.toCharArray();\n        }\n\n        @Override\n        public String createSessionId() {\n            if (random == null) {\n                random = new SecureRandom();\n            }\n            final byte[] bytes = new byte[length];\n            random.nextBytes(bytes);\n            return new String(encode(bytes));\n        }\n\n        public int getLength() {\n            return length;\n        }","sourceCodeStart":812,"sourceCodeEnd":848,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/undertow/runtime/src/main/java/io/quarkus/undertow/runtime/UndertowDeploymentRecorder.java#L812-L848","documentation":"A static initializer in UndertowDeploymentRecorder configures the session-id alphabet via the system property io.undertow.server.session.SecureRandomSessionIdGenerator.ALPHABET. Undertow requires this alphabet to contain exactly 64 distinct characters; Quarkus enforces it and throws a RuntimeException at build/start time otherwise.","triggerScenarios":"The JVM is started with -Dio.undertow.server.session.SecureRandomSessionIdGenerator.ALPHABET set to a string whose length is not exactly 64.","commonSituations":"Copy-pasted system property with a truncated or extended alphabet; security hardening scripts that add/remove characters; typo when overriding the default.","solutions":["Set the property to exactly 64 characters, or remove the -D flag to use the default alphabet","Count the characters programmatically before setting it","Avoid characters outside [A-Za-z0-9-_] unless you also account for URL-safety"],"exampleFix":"// before\njava -Dio.undertow.server.session.SecureRandomSessionIdGenerator.ALPHABET=ABC... (not 64 chars) app.jar\n// after\njava -Dio.undertow.server.session.SecureRandomSessionIdGenerator.ALPHABET=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_ app.jar","handlingStrategy":"validation","validationCode":"String a = System.getProperty(\"io.undertow.server.session.SecureRandomSessionIdGenerator.ALPHABET\");\nif (a != null && a.length() != 64) throw new IllegalArgumentException(\"ALPHABET must be exactly 64 chars, got \" + a.length());","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep the default alphabet unless you have a strict requirement","Add a startup check script for custom -D properties","Never hand-truncate the 64-char alphabet"],"tags":["undertow","session-id","system-property","quarkus"],"backgroundTag":"invalid-config-value","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}