{"record":{"id":"c6bc6d1924f897ed","repo":"apereo/cas","slug":"encryption-signing-is-not-enabled-explicitly-in-th","errorCode":null,"errorMessage":"Encryption/Signing is not enabled explicitly in the configuration for cookie [{}], yet signing/encryption keys are defined for operations. CAS will proceed to enable the cookie encryption/signing functionality.","messagePattern":"Encryption/Signing is not enabled explicitly in the configuration for cookie \\[(.+?)\\], yet signing/encryption keys are defined for operations\\. CAS will proceed to enable the cookie encryption/signing functionality\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-pac4j-webflow/src/main/java/org/apereo/cas/config/DelegatedAuthenticationEventExecutionPlanConfiguration.java","lineNumber":142,"sourceCode":"    }\n\n    @Configuration(value = \"DelegatedAuthenticationEventExecutionPlanCoreConfiguration\", proxyBeanMethods = false)\n    @EnableConfigurationProperties(CasConfigurationProperties.class)\n    static class DelegatedAuthenticationEventExecutionPlanCoreConfiguration {\n\n        @ConditionalOnMissingBean(name = \"delegatedClientDistributedSessionCookieCipherExecutor\")\n        @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT)\n        @Bean\n        public CipherExecutor delegatedClientDistributedSessionCookieCipherExecutor(final CasConfigurationProperties casProperties) {\n            val replication = casProperties.getAuthn().getPac4j().getCore().getSessionReplication();\n            return FunctionUtils.doIf(replication.isReplicateSessions(),\n                () -> {\n                    val cookie = replication.getCookie();\n                    val crypto = cookie.getCrypto();\n                    var enabled = crypto.isEnabled();\n                    if (!enabled && StringUtils.isNotBlank(crypto.getEncryption().getKey())\n                        && StringUtils.isNotBlank(crypto.getSigning().getKey())) {\n                        LOGGER.warn(\"Encryption/Signing is not enabled explicitly in the configuration for cookie [{}], yet signing/encryption keys \"\n                            + \"are defined for operations. CAS will proceed to enable the cookie encryption/signing functionality.\", cookie.getName());\n                        enabled = true;\n                    }\n                    return enabled\n                        ? CipherExecutorUtils.newStringCipherExecutor(crypto, DelegatedClientAuthenticationDistributedSessionCookieCipherExecutor.class)\n                        : CipherExecutor.noOp();\n                },\n                CipherExecutor::noOp).get();\n        }\n\n        @ConditionalOnMissingBean(name = \"delegatedClientDistributedSessionCookieGenerator\")\n        @Bean\n        @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT)\n        @Deprecated(since = \"7.3.0\", forRemoval = true)\n        public CasCookieBuilder delegatedClientDistributedSessionCookieGenerator(\n            @Qualifier(TenantExtractor.BEAN_NAME)\n            final TenantExtractor tenantExtractor,\n            @Qualifier(GeoLocationService.BEAN_NAME)","sourceCodeStart":124,"sourceCodeEnd":160,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-pac4j-webflow/src/main/java/org/apereo/cas/config/DelegatedAuthenticationEventExecutionPlanConfiguration.java#L124-L160","documentation":"DelegatedAuthenticationEventExecutionPlanConfiguration, when building the delegatedClientDistributedSessionCookieCipherExecutor bean, warns if the distributed-session cookie's crypto.enabled flag is false but both encryption and signing keys are configured. CAS assumes the keys imply intent and force-enables crypto rather than silently ignoring them.","triggerScenarios":"cas.authn.pac4j.cookie.crypto.enabled=false (or unset) while cas.authn.pac4j.cookie.crypto.encryption.key and .signing.key are both set, at configuration time of the delegated authentication plan.","commonSituations":"Operators pasted key-generation output (cas authn pac4j cookie generate-key) but forgot to flip enabled=true; config copied from a template where enabled was explicitly false; keys inherited from environment variables with enabled left at default false.","solutions":["Set cas.authn.pac4j.cookie.crypto.enabled=true to make the intent explicit and remove the warning.","If encryption/signing is truly not wanted, remove the encryption.key and signing.key values so the keys and the flag agree.","Restart and confirm only one of the two states (enabled with keys, or disabled with no keys) is configured."],"exampleFix":"// before\ncas.authn.pac4j.cookie.crypto.enabled=false\ncas.authn.pac4j.cookie.crypto.signing.key=...\ncas.authn.pac4j.cookie.crypto.encryption.key=...\n// after\ncas.authn.pac4j.cookie.crypto.enabled=true\ncas.authn.pac4j.cookie.crypto.signing.key=...\ncas.authn.pac4j.cookie.crypto.encryption.key=...","handlingStrategy":"validation","validationCode":"var crypto = casProperties.getAuthn().getPac4j().getCookie().getCrypto();\nif (!crypto.isEnabled() && (StringUtils.isNotBlank(crypto.getEncryption().getKey()) || StringUtils.isNotBlank(crypto.getSigning().getKey()))) {\n    throw new IllegalStateException(\"cookie crypto keys set but crypto.enabled=false\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat crypto.enabled and key presence as one unit when editing config.","If keys are provisioned by tooling, have the tooling set enabled=true too."],"tags":["configuration","cookie-crypto","delegated-authentication","pac4j"],"backgroundTag":"conflicting-config-options","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}