{"record":{"id":"91125a884c7acf7d","repo":"quarkusio/quarkus","slug":"secret-key-for-encrypting-state-cookie-is-less-tha","errorCode":null,"errorMessage":"Secret key for encrypting state cookie is less than 16 characters long","messagePattern":"Secret key for encrypting state cookie is less than 16 characters long","errorType":"validation","errorClass":"io.quarkus.runtime.configuration.ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantConfigContextImpl.java","lineNumber":154,"sourceCode":"                if (possiblePkceSecret != null && possiblePkceSecret.length() < 32) {\n                    LOG.debug(\"Client secret is less than 32 characters long, the state secret will be generated\");\n                } else {\n                    stateSecret = possiblePkceSecret;\n                }\n            }\n            try {\n                if (stateSecret == null) {\n                    LOG.debug(\"Secret key for encrypting state cookie is missing, auto-generating it\");\n                    SecretKey key = OidcCommonUtils.generateSecretKey();\n                    return key;\n                }\n                byte[] secretBytes = stateSecret.getBytes(StandardCharsets.UTF_8);\n                if (secretBytes.length < 32) {\n                    String errorMessage = \"Secret key for encrypting state cookie should be at least 32 characters long\"\n                            + \" for the strongest state cookie encryption to be produced.\"\n                            + \" Please update 'quarkus.oidc.authentication.state-secret' or update the configured client secret.\";\n                    if (secretBytes.length < 16) {\n                        throw new ConfigurationException(\n                                \"Secret key for encrypting state cookie is less than 16 characters long\");\n                    } else {\n                        LOG.debug(errorMessage);\n                    }\n                }\n                return new SecretKeySpec(OidcUtils.getSha256Digest(secretBytes), \"AES\");\n            } catch (Exception ex) {\n                throw new OIDCException(ex);\n            }\n        }\n        return null;\n    }\n\n    private static SecretKey createTokenEncSecretKey(OidcTenantConfig config, OidcProvider provider, String clientOrJwtSecret) {\n        if (config.tokenStateManager().encryptionRequired()) {\n            String encSecret = null;\n            if (config.tokenStateManager().encryptionSecret().isPresent()) {\n                encSecret = config.tokenStateManager().encryptionSecret().get();","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantConfigContextImpl.java#L136-L172","documentation":"TenantConfigContextImpl.createStateSecretKey throws ConfigurationException when the secret used to encrypt the OIDC state cookie is shorter than 16 characters (after UTF-8 encoding). AES state cookie encryption requires at least a 16-byte secret; under 32 bytes only logs a debug warning about weaker encryption.","triggerScenarios":"Initializing tenant state cookie encryption (createStateSecretKey, called by stateCookieEncryptionKey) with a 'quarkus.oidc.authentication.state-secret' or client secret whose UTF-8 bytes are < 16; the length check throws ConfigurationException.","commonSituations":"Short demo secrets in production configs; short client secrets from an IdP used for encryption; truncation or encoding mistakes reducing byte length below 16 (multi-byte chars vs chars).","solutions":["Set quarkus.oidc.authentication.state-secret to a random secret of at least 32 characters (recommended) and never less than 16","Use a longer client secret in the IdP if the client secret is the encryption source","Generate the secret securely, e.g. openssl rand -base64 32"],"exampleFix":"// before\nquarkus.oidc.authentication.state-secret=short\n// after\nquarkus.oidc.authentication.state-secret=dGhpcy1pcy1hLTMyLWNoYXItc2VjcmV0LWtleSEhIQ==","handlingStrategy":"validation","validationCode":"int len = secret.getBytes(StandardCharsets.UTF_8).length;\nif (len < 16) throw new IllegalArgumentException(\"state-secret must be >= 16 chars (32 recommended), got \" + len);","typeGuard":null,"tryCatchPattern":"try { startApplication(); } catch (ConfigurationException e) { fail(\"Provide a >=32-char quarkus.oidc.authentication.state-secret\"); }","preventionTips":["Generate secrets with openssl rand -base64 32","Keep secrets in env/vault, never hardcode short values","Check byte length (UTF-8), not just character count, for multi-byte secrets"],"tags":["oidc","configuration","state-cookie","encryption","secret-length"],"backgroundTag":"weak-encryption-secret","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}