{"record":{"id":"dddc323e95e4a388","repo":"ory/hydra","slug":"ciphertext-too-short","errorCode":null,"errorMessage":"ciphertext too short","messagePattern":"ciphertext too short","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/pagination/keysetpagination_v2/page_token.go","lineNumber":236,"sourceCode":"\t}\n\n\tif err := json.Unmarshal(dec, t); err != nil {\n\t\tif errors.As(err, new(*herodot.DefaultError)) {\n\t\t\treturn err\n\t\t}\n\t\treturn errors.WithStack(herodot.ErrInternalServerError().WithReason(\"unable to unmarshal page token\").WithDebug(err.Error()))\n\t}\n\n\treturn nil\n}\n\nfunc openAEAD(key [32]byte, raw []byte) ([]byte, error) {\n\ta, err := aead.New(key)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"cannot create AEAD\")\n\t}\n\tif len(raw) < a.NonceSize() {\n\t\treturn nil, errors.New(\"ciphertext too short\")\n\t}\n\tnonce, ciphertext := raw[:a.NonceSize()], raw[a.NonceSize():]\n\tbs, err := a.Open(nil, nonce, ciphertext, []byte(pageTokenContext))\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"cannot open AEAD\")\n\t}\n\n\treturn bs, nil\n}\n","sourceCodeStart":218,"sourceCodeEnd":246,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/pagination/keysetpagination_v2/page_token.go#L218-L246","documentation":"Returned by openAEAD when a decrypted page token's raw bytes are shorter than the AEAD nonce size. The token is malformed or truncated: it cannot even be split into nonce and ciphertext, so authentication is never attempted.","triggerScenarios":"Thrown at oryx/pagination/keysetpagination_v2/page_token.go:236 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Treat the token as invalid and return the first/unpaged result set instead of failing the request","Check token length before calling decrypt and short-circuit to the invalid-token path","Regenerate a valid token by issuing a fresh first-page request"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}