{"record":{"id":"df71f085c6b85f83","repo":"apereo/cas","slug":"token-encryption-signing-is-not-enabled-explicitly-df71f0","errorCode":null,"errorMessage":"Token encryption/signing is not enabled explicitly in the configuration for cookie [{}], yet signing/encryption keys are defined for operations. CAS will proceed to enable the cookie encryption/signing functionality.","messagePattern":"Token encryption/signing is not enabled explicitly in the configuration for cookie \\[(.+?)\\], yet signing/encryption keys are defined for operations\\. CAS will proceed to enable the cookie encryption/signing functionality\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-trusted-mfa/src/main/java/org/apereo/cas/config/MultifactorAuthnTrustedDeviceFingerprintConfiguration.java","lineNumber":207,"sourceCode":"        public CookieValueManager deviceFingerprintCookieValueManager(\n            @Qualifier(TenantExtractor.BEAN_NAME)\n            final TenantExtractor tenantExtractor,\n            @Qualifier(\"deviceFingerprintCookieCipherExecutor\")\n            final CipherExecutor deviceFingerprintCookieCipherExecutor) {\n            return new EncryptedCookieValueManager(\n                CipherExecutorResolver.with(deviceFingerprintCookieCipherExecutor),\n                tenantExtractor, DefaultCookieSameSitePolicy.INSTANCE);\n        }\n\n        @ConditionalOnMissingBean(name = \"deviceFingerprintCookieCipherExecutor\")\n        @Bean\n        @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT)\n        public CipherExecutor deviceFingerprintCookieCipherExecutor(final CasConfigurationProperties casProperties) {\n            val cookie = casProperties.getAuthn().getMfa().getTrusted().getDeviceFingerprint().getCookie();\n            val crypto = cookie.getCrypto();\n            var enabled = crypto.isEnabled();\n            if (!enabled && StringUtils.isNotBlank(crypto.getEncryption().getKey()) && StringUtils.isNotBlank(crypto.getSigning().getKey())) {\n                LOGGER.warn(\"Token encryption/signing is not enabled explicitly in the configuration for cookie [{}], yet \"\n                            + \"signing/encryption keys are defined for operations. CAS will proceed to enable the cookie \"\n                            + \"encryption/signing functionality.\", cookie.getName());\n                enabled = true;\n            }\n            if (enabled) {\n                return CipherExecutorUtils.newStringCipherExecutor(crypto, CookieDeviceFingerprintComponentCipherExecutor.class);\n            }\n            return CipherExecutor.noOp();\n        }\n\n    }\n\n    @AutoConfigureOrder(Ordered.LOWEST_PRECEDENCE)\n    @ConditionalOnBean(name = GeoLocationService.BEAN_NAME)\n    @Configuration(value = \"MultifactorAuthnTrustedDeviceGeoLocationConfiguration\", proxyBeanMethods = false)\n    @EnableConfigurationProperties(CasConfigurationProperties.class)\n    static class MultifactorAuthnTrustedDeviceGeoLocationConfiguration {\n        @Bean","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-trusted-mfa/src/main/java/org/apereo/cas/config/MultifactorAuthnTrustedDeviceFingerprintConfiguration.java#L189-L225","documentation":"When the device-fingerprint cookie's crypto signing and encryption keys are both set but crypto.enabled is false, CAS warns and force-enables cookie signing/encryption anyway. The feature works, but the configuration is ambiguous; CAS is telling you to make the intent explicit.","triggerScenarios":"In deviceFingerprintCookieCipherExecutor, crypto.isEnabled() is false while both cas.authn.mfa.trusted.device-fingerprint.cookie.crypto.encryption.key and .signing.key are non-blank; CAS flips enabled=true and proceeds to build a CookieDeviceFingerprintComponentCipherExecutor.","commonSituations":"Copy-pasting crypto key config from cookie examples while forgetting cas.authn.mfa.trusted.device-fingerprint.cookie.crypto.enabled=true; keys left over from an earlier setup after toggling enabled=false; environment-variable-injected keys that make enabled=false misleading.","solutions":["Explicitly set cas.authn.mfa.trusted.device-fingerprint.cookie.crypto.enabled=true since you intend signing/encryption.","If you actually want the cookie unsigned/unencrypted, remove the crypto.encryption.key and crypto.signing.key values so the warning disappears.","Set the keys via secure config (env vars/secrets) and keep enabled=true in the same config source to avoid drift."],"exampleFix":"// before\ncas.authn.mfa.trusted.device-fingerprint.cookie.crypto.enabled=false\ncas.authn.mfa.trusted.device-fingerprint.cookie.crypto.encryption.key=xyz\ncas.authn.mfa.trusted.device-fingerprint.cookie.crypto.signing.key=abc\n\n// after\ncas.authn.mfa.trusted.device-fingerprint.cookie.crypto.enabled=true\ncas.authn.mfa.trusted.device-fingerprint.cookie.crypto.encryption.key=xyz\ncas.authn.mfa.trusted.device-fingerprint.cookie.crypto.signing.key=abc","handlingStrategy":"validation","validationCode":"var crypto = casProperties.getAuthn().getMfa().getTrusted().getDeviceFingerprint().getCookie().getCrypto();\nif (!crypto.isEnabled() && StringUtils.isNotBlank(crypto.getEncryption().getKey()) && StringUtils.isNotBlank(crypto.getSigning().getKey())) {\n    throw new IllegalStateException(\"Set cookie crypto.enabled=true or remove the signing/encryption keys\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep crypto.enabled and the key settings in the same config file/source so they never disagree.","Audit cookie crypto settings whenever promoting config between environments.","Treat this warn line in logs as a config smell to fix, not to ignore."],"tags":["configuration","crypto","cookie","mfa"],"backgroundTag":"conflicting-config-options","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}