{"record":{"id":"9628b2520ef15dbb","repo":"OpenNHP/opennhp","slug":"base64-decode-failed-w","errorCode":null,"errorMessage":"base64 decode failed: %w","messagePattern":"base64 decode failed: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"endpoints/server/config.go","lineNumber":46,"sourceCode":"// copy the demo and forget to rotate the key get a loud warning\n// instead of silently running with a public secret.\n//\n// Keep this in sync with docker/nhp-server/etc/config.toml (and\n// docker/nhp-server/etc2/config.toml, which intentionally shares the\n// same value to enable the same-key multi-instance demo). If we ever\n// rotate the demo key, update this constant in the same commit.\nconst shippedDemoCookieSigningKeyBase64 = \"w62S2G1P5GOG66Y5tIv3WlfBv8CNBdDe2JJDFr9Q+h0=\"\n\n// decodeCookieSigningKey parses a base64-encoded 32-byte cookie signing\n// key. An empty input yields (nil, nil): the caller will fall back to a\n// random per-process key, which is fine for single-instance deployments.\nfunc decodeCookieSigningKey(b64 string) ([]byte, error) {\n\tif b64 == \"\" {\n\t\treturn nil, nil\n\t}\n\traw, err := base64.StdEncoding.DecodeString(b64)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"base64 decode failed: %w\", err)\n\t}\n\tif len(raw) != 32 {\n\t\treturn nil, fmt.Errorf(\"cookie signing key must be exactly 32 bytes after base64 decode, got %d\", len(raw))\n\t}\n\treturn raw, nil\n}\n\nvar (\n\tbaseConfigWatch  io.Closer\n\thttpConfigWatch  io.Closer\n\tacConfigWatch    io.Closer\n\tagentConfigWatch io.Closer\n\tresConfigWatch   io.Closer\n\tsrcipConfigWatch io.Closer\n\tdbConfigWatch    io.Closer\n\trelayConfigWatch io.Closer\n\tteeWatch         io.Closer\n\terrLoadConfig    = fmt.Errorf(\"config load error\")","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/server/config.go#L28-L64","documentation":"Raised by the nhp-server helper decodeCookieSigningKey: the cookie_signing_key value from config failed standard base64 decoding. This is the operator-supplied key used to sign cookies across instances; the shipped demo key constant is only a fallback reference, and a mangled copy of it (or any invalid base64) triggers this error at startup or config update.","triggerScenarios":"Thrown at endpoints/server/config.go:46 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate a 32-byte key and encode it with standard base64 (e.g. openssl rand -base64 32)","Copy the full string without truncation, whitespace, or smart quotes","Keep the value in sync with docker/nhp-server/etc/config.toml conventions documented in the code"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}