{"record":{"id":"ab669b727157055b","repo":"yiisoft/yii2","slug":"failed-to-generate-hmac-with-hash-algorithm-mach","errorCode":null,"errorMessage":"Failed to generate HMAC with hash algorithm: {macHash}","messagePattern":"Failed to generate HMAC with hash algorithm: (.+?)","errorType":"exception","errorClass":"InvalidConfigException","httpStatus":null,"severity":"error","filePath":"framework/base/Security.php","lineNumber":353,"sourceCode":"     * There is no need to hash inputs or outputs of [[encryptByKey()]] or [[encryptByPassword()]]\n     * as those methods perform the task.\n     * @param string $data the data to be protected\n     * @param string $key the secret key to be used for generating hash. Should be a secure\n     * cryptographic key.\n     * @param bool $rawHash whether the generated hash value is in raw binary format. If false, lowercase\n     * hex digits will be generated.\n     * @return string the data prefixed with the keyed hash\n     * @throws InvalidConfigException when HMAC generation fails.\n     * @see validateData()\n     * @see generateRandomKey()\n     * @see hkdf()\n     * @see pbkdf2()\n     */\n    public function hashData($data, $key, $rawHash = false)\n    {\n        $hash = hash_hmac($this->macHash, $data, $key, $rawHash);\n        if (!$hash) {\n            throw new InvalidConfigException('Failed to generate HMAC with hash algorithm: ' . $this->macHash);\n        }\n\n        return $hash . $data;\n    }\n\n    /**\n     * Validates if the given data is tampered.\n     * @param string $data the data to be validated. The data must be previously\n     * generated by [[hashData()]].\n     * @param string $key the secret key that was previously used to generate the hash for the data in [[hashData()]].\n     * function to see the supported hashing algorithms on your system. This must be the same\n     * as the value passed to [[hashData()]] when generating the hash for the data.\n     * @param bool $rawHash this should take the same value as when you generate the data using [[hashData()]].\n     * It indicates whether the hash value in the data is in binary format. If false, it means the hash value consists\n     * of lowercase hex digits only.\n     * hex digits will be generated.\n     * @return string|false the real data with the hash stripped off. False if the data is tampered.\n     * @throws InvalidConfigException when HMAC generation fails.","sourceCodeStart":335,"sourceCodeEnd":371,"githubUrl":"https://github.com/yiisoft/yii2/blob/66f00d18a29b520f85e8e8f1e32d1e7e7b556cac/framework/base/Security.php#L335-L371","documentation":"Security::hashData() computes hash_hmac() under the component's macHash and throws InvalidConfigException when the call returns falsy, which happens when macHash names an algorithm the hash extension does not recognize. The shipped default ('sha-256') works on standard builds, so in practice this error means macHash was customized to a misspelled or unavailable name (e.g. 'sha3512', or an algorithm not compiled into the runtime).","triggerScenarios":"'components' => ['security' => ['macHash' => 'sha512-hmac']] (not an algorithm name); switching macHash to an exotic hash not present in hash_hmac_algos() on the target build; per-environment config where only one environment sets a bad value.","commonSituations":"Compliance-driven algorithm changes without verifying the runtime; config copied from other projects; typos in environment-specific security blocks.","solutions":["Reset macHash to the default 'sha-256' or pick a name from hash_hmac_algos() in the target runtime","Validate the configured name with in_array($macHash, hash_hmac_algos(), true) at bootstrap","If changing macHash deliberately, re-issue data hashed under the old algorithm (cookies/tokens signed by hashData will otherwise fail validation)"],"exampleFix":"// before\n'components' => [\n    'security' => ['macHash' => 'sha-512-hmac'], // not a real algorithm name\n],\n\n// after\n'components' => [\n    'security' => ['macHash' => 'sha-256'],\n],","handlingStrategy":"validation","validationCode":"if (!in_array(Yii::$app->security->macHash, hash_hmac_algos(), true)) {\n    throw new \\RuntimeException('macHash not supported: ' . Yii::$app->security->macHash);\n}\n$signed = Yii::$app->security->hashData($data, $key);","typeGuard":null,"tryCatchPattern":"try {\n    $signed = Yii::$app->security->hashData($data, $key);\n} catch (\\yii\\base\\InvalidConfigException $e) {\n    // unsupported macHash — environment config error, no retry\n}","preventionTips":["Leave macHash at the default 'sha-256' unless every target runtime supports the replacement","Validate macHash against hash_hmac_algos() in CI for all environments","Remember to re-sign existing cookies/tokens after any macHash change"],"tags":["php","yii2","security","hmac","hash","config"],"backgroundTag":"unsupported-hash-algorithm","analyzedSha":"66f00d18a29b520f85e8e8f1e32d1e7e7b556cac","analyzedAt":"2026-08-17T05:17:23.470Z","schemaVersion":2},"datasetVersion":"2026-08-17T09:17:11.063Z"}