{"record":{"id":"9859151ad144f227","repo":"denoland/deno","slug":"err-crypto-fips-forced","errorCode":"ERR_CRYPTO_FIPS_FORCED","errorMessage":"Cannot set FIPS mode, it was forced with --force-fips at startup.","messagePattern":"Cannot set FIPS mode, it was forced with --force-fips at startup\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/crypto.ts","lineNumber":364,"sourceCode":"  options?: TransformOptions,\n) {\n  return Hmac_(hmac, key, options);\n}\n\nfunction createSign(algorithm: string, options?: WritableOptions): Sign {\n  return new Sign(algorithm, options);\n}\n\nfunction createVerify(algorithm: string, options?: WritableOptions): Verify {\n  return new Verify(algorithm, options);\n}\n\nfunction setFipsForced(val: boolean) {\n  if (val) {\n    return;\n  }\n\n  throw new ERR_CRYPTO_FIPS_FORCED();\n}\n\nfunction getFipsForced() {\n  return 1;\n}\n\nObjectDefineProperty(constants, \"defaultCipherList\", {\n  __proto__: null,\n  value: getOptionValue(\"--tls-cipher-list\"),\n});\n\nconst getDiffieHellman = createDiffieHellmanGroup;\n\nconst getFips = fipsForced ? getFipsForced : getFipsCrypto;\nconst setFips = fipsForced ? setFipsForced : setFipsCrypto;\n\nconst sign = signOneShot;\nconst verify = verifyOneShot;","sourceCodeStart":346,"sourceCodeEnd":382,"githubUrl":"https://github.com/denoland/deno/blob/89f33cbef296a2b287f323d42de54c871fa69c77/ext/node/polyfills/crypto.ts#L346-L382","documentation":"When the runtime starts in forced-FIPS mode, setFips is wired to setFipsForced (see the fipsForced selection at crypto.ts:378-379): enabling FIPS again is a silent no-op, but any attempt to disable it throws ERR_CRYPTO_FIPS_FORCED, because the startup decision must not be relaxed at runtime.","triggerScenarios":"Starting Deno/Node with --force-fips, then calling crypto.setFips(false); libraries or perf tweaks that toggle setFips(!isProd) unconditionally; code that calls setFips(false) as 'cleanup' after a setFips(true) probe.","commonSituations":"Compliance-mandated environments where operators force FIPS while application code assumes it can toggle it; shared crypto wrappers managing FIPS from config; CI running with different flags than production.","solutions":["Do not call setFips(false) when FIPS is forced — keep it enabled","Gate the call on startup flags: skip when process.execArgv includes '--force-fips'","Check crypto.getFips() first; in forced mode it always returns 1"],"exampleFix":"// before\ncrypto.setFips(false);\n// after\nif (!process.execArgv.includes(\"--force-fips\")) crypto.setFips(false);","handlingStrategy":"try-catch","validationCode":"const fipsForcedAtStartup =\n  process.execArgv.includes(\"--force-fips\") || process.env.NODE_FORCE_FIPS === \"1\";\nif (!fipsForcedAtStartup) crypto.setFips(enableFips);","typeGuard":null,"tryCatchPattern":"try {\n  crypto.setFips(false);\n} catch (e) {\n  if (e.code === \"ERR_CRYPTO_FIPS_FORCED\") {\n    // FIPS locked at startup — keep it enabled and continue\n  } else throw e;\n}","preventionTips":["Never hardcode setFips(false) in shared libraries","Check crypto.getFips() (always 1 when forced) before toggling","Document FIPS requirements in deployment configuration so ops and app code agree"],"tags":["crypto","fips","compliance","startup-flags"],"backgroundTag":null,"analyzedSha":"89f33cbef296a2b287f323d42de54c871fa69c77","analyzedAt":"2026-08-16T07:54:21.310Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}