{"record":{"id":"9a5d62aeb1ceeba3","repo":"ory/kratos","slug":"you-must-provide-secrets-default-for-fips-compli","errorCode":null,"errorMessage":"you must provide `secrets.default` for FIPS compliance","messagePattern":"you must provide `secrets\\.default` for FIPS compliance","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"driver/config/config.go","lineNumber":444,"sourceCode":"\n\tc = NewCustom(l, p, stdOutOrErr, ctxer)\n\n\tif !p.SkipValidation() {\n\t\tif err := c.validateIdentitySchemas(ctx); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif fips140.Enabled() {\n\t\t\tif len(p.Strings(ViperKeySecretsPagination)) == 0 {\n\t\t\t\treturn nil, errors.New(\"you must provide `secrets.pagination` for FIPS compliance\")\n\t\t\t}\n\t\t\tif len(p.Strings(ViperKeySecretsCipher)) == 0 {\n\t\t\t\treturn nil, errors.New(\"you must provide `secrets.cipher` for FIPS compliance\")\n\t\t\t}\n\t\t\tif len(p.Strings(ViperKeySecretsCookie)) == 0 {\n\t\t\t\treturn nil, errors.New(\"you must provide `secrets.cookie` for FIPS compliance\")\n\t\t\t}\n\t\t\tif len(p.Strings(ViperKeySecretsDefault)) == 0 {\n\t\t\t\treturn nil, errors.New(\"you must provide `secrets.default` for FIPS compliance\")\n\t\t\t}\n\t\t}\n\t}\n\n\treturn c, nil\n}\n\nfunc NewCustom(l *logrusx.Logger, p *configx.Provider, stdOutOrErr io.Writer, ctxt contextx.Contextualizer) *Config {\n\tl.UseConfig(p)\n\treturn &Config{l: l, p: p, c: ctxt, stdOutOrErr: stdOutOrErr}\n}\n\nfunc (p *Config) getIdentitySchemaValidator(ctx context.Context) (*jsonschema.Schema, error) {\n\tif p.identityMetaSchema == nil {\n\t\tc := jsonschema.NewCompiler()\n\t\terr := embedx.AddSchemaResources(c, embedx.IdentityMeta)\n\t\tif err != nil {\n\t\t\treturn nil, err","sourceCodeStart":426,"sourceCodeEnd":462,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/driver/config/config.go#L426-L462","documentation":"In FIPS 140 mode, the validator requires an explicit `secrets.default` value — the default secret pool used for hashing/signing. Empty `secrets.default` fails validation because FIPS mode cannot fall back to generated secrets.","triggerScenarios":"Startup with FIPS enabled and `secrets.default` absent/empty while the other FIPS-required secrets may or may not be set (this is the last check in the chain).","commonSituations":"Partially migrated FIPS configs where pagination/cipher/cookie were set but `default` was overlooked.","solutions":["Add `secrets.default` with one or more long random strings","Rotate/set all four FIPS-required secret keys as a unit in your config management","Generate values with a FIPS-approved RNG","Disable fips140 if FIPS compliance was not intended"],"exampleFix":"// before\nsecrets:\n  pagination: [\"...\"]\n  cipher: [\"...\"]\n  cookie: [\"...\"]\n// after\nsecrets:\n  pagination: [\"...\"]\n  cipher: [\"...\"]\n  cookie: [\"...\"]\n  default: [\"random-default-secret-32-chars-min\"]","handlingStrategy":"validation","validationCode":"if fipsEnabled && len(cfg.Secrets.Default) == 0 {\n  return errors.New(\"secrets.default is required in FIPS mode\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set all four FIPS-required secret keys as a single atomic change","Validate the full config with the same validation path in staging before production rollout","Never partially migrate: enable FIPS only after secrets are provisioned"],"tags":["config","fips","security"],"backgroundTag":"missing-required-config-field","analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}