{"record":{"id":"8619ea7db663ed6d","repo":"rwf2/Rocket","slug":"insecuresecretkey","errorCode":"InsecureSecretKey","errorMessage":"insecure secret key config","messagePattern":"insecure secret key config","errorType":"exception","errorClass":"rocket::error::Error","httpStatus":null,"severity":"critical","filePath":"core/lib/src/rocket.rs","lineNumber":549,"sourceCode":"    ///     assert_eq!(rocket.state::<String>().unwrap(), \"managed string\");\n    ///\n    ///     Ok(())\n    /// }\n    /// ```\n    pub async fn ignite(mut self) -> Result<Rocket<Ignite>, Error> {\n        self = Fairings::handle_ignite(self).await;\n        self.fairings.audit().map_err(|f| ErrorKind::FailedFairings(f.to_vec()))?;\n\n        // Extract the configuration; initialize default trace subscriber.\n        #[allow(unused_mut)]\n        let mut config = Config::try_from(&self.figment).map_err(ErrorKind::Config)?;\n        crate::trace::init(&config);\n\n        // Check for safely configured secrets.\n        #[cfg(feature = \"secrets\")]\n        if !config.secret_key.is_provided() {\n            if config.profile != Config::DEBUG_PROFILE {\n                return Err(Error::new(ErrorKind::InsecureSecretKey(config.profile.clone())));\n            }\n\n            if config.secret_key.is_zero() {\n                config.secret_key = crate::config::SecretKey::generate()\n                    .unwrap_or_else(crate::config::SecretKey::zero);\n            }\n        }\n\n        // Initialize the router; check for collisions.\n        let mut router = Router::new();\n        self.routes.clone().into_iter().for_each(|r| router.routes.push(r));\n        self.catchers.clone().into_iter().for_each(|c| router.catchers.push(c));\n        let router = router.finalize()\n            .map_err(|(r, c)| ErrorKind::Collisions { routes: r, catchers: c, })?;\n\n        // Finally, freeze managed state for faster access later.\n        self.state.freeze();\n","sourceCodeStart":531,"sourceCodeEnd":567,"githubUrl":"https://github.com/rwf2/Rocket/blob/3a54d079aef060a8f732bd04ea54b0581a604087/core/lib/src/rocket.rs#L531-L567","documentation":"Ignition error from Rocket::ignite (core/lib/src/rocket.rs): when the 'secrets' feature is enabled (required for private cookies), Rocket refuses to start if secret_key is not provided and the active config profile is not the debug profile. Since private cookies signed with the zero/default key are forgeable, running a non-debug profile without an explicit key is treated as a fatal configuration error (ErrorKind::InsecureSecretKey). In debug profile a key is auto-generated, but only for local development.","triggerScenarios":"Building with features = [\"secrets\"] and launching with profile release (or any custom/ROCKET_PROFILE non-debug value) while neither ROCKET_SECRET_KEY nor secret_key in Rocket.toml is set. The check happens in Rocket::ignite/launch before the server binds.","commonSituations":"Enabling private cookies for the first time and deploying with ROCKET_PROFILE=release; Docker images that drop the env var; CI smoke tests using a release build without config; upgrading where secret_key previously came from a now-missing file.","solutions":["Set a real key: generate with `rocket secret` and put it in Rocket.toml ([default] secret_key = \"...\") or export ROCKET_SECRET_KEY","For production, load it from your secret manager and provide via env var (ROCKET_SECRET_KEY) rather than committing it","If it's intentional (e.g. staging without secrets), set an actual key anyway — a zero key makes private cookies forgeable","Verify the active profile: ROCKET_PROFILE defaults to debug locally but deployments often set release"],"exampleFix":"# before\n$ ROCKET_PROFILE=release ./myapp  # secrets feature enabled, no key\nError: insecure secret key config\n\n# after\n$ ROCKET_SECRET_KEY=$(rocket secret) ROCKET_PROFILE=release ./myapp\n# or Rocket.toml:\n# [release]\n# secret_key = \"hPRYyVRiMyxpw5sBBPRXykN1DRjOXedX7 pruBJAeaYU=\"","handlingStrategy":"validation","validationCode":"// fail fast in main before ignite if secrets are required but missing\nfn ensure_secret_key() {\n    #[cfg(feature = \"secrets\")]\n    if std::env::var(\"ROCKET_SECRET_KEY\").map(|k| k.is_empty()).unwrap_or(true) {\n        eprintln!(\"ROCKET_SECRET_KEY must be set when the secrets feature is enabled\");\n        std::process::exit(1);\n    }\n}","typeGuard":null,"tryCatchPattern":"let rocket = rocket::build();\n// In production, treat InsecureSecretKey as fatal and report configuration, not stack\nif let Err(e) = rocket.launch().await {\n    eprintln!(\"launch failed: {e}\");\n    std::process::exit(1);\n}","preventionTips":["Add `rocket secret` output to your deployment checklist and secret manager before enabling secrets","Set ROCKET_PROFILE explicitly in every environment so debug-only autogeneration never surprises you","Smoke-test the release build in CI with a dummy key so config drift is caught before deploy"],"tags":["rust","rocket","security","secret-key","configuration","startup"],"backgroundTag":"missing-secret-key","analyzedSha":"3a54d079aef060a8f732bd04ea54b0581a604087","analyzedAt":"2026-08-16T22:01:48.395Z","schemaVersion":2},"datasetVersion":"2026-08-16T23:17:17.608Z"}