{"record":{"id":"e1e46a476d43e5bc","repo":"quarkusio/quarkus","slug":"shared-keys-for-persistent-logins-must-be-more-tha","errorCode":null,"errorMessage":"Shared keys for persistent logins must be more than 16 characters long","messagePattern":"Shared keys for persistent logins must be more than 16 characters long","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/PersistentLoginManager.java","lineNumber":59,"sourceCode":"    private final String cookiePath;\n    private final long maxAgeSeconds;\n    private final String cookieDomain;\n\n    public PersistentLoginManager(String encryptionKey, String cookieName, long timeoutMillis, long newCookieIntervalMillis,\n            boolean httpOnlyCookie, String cookieSameSite, String cookiePath, long maxAgeSeconds, String cookieDomain) {\n        this.cookieName = cookieName;\n        this.newCookieIntervalMillis = newCookieIntervalMillis;\n        this.timeoutMillis = timeoutMillis;\n        this.httpOnlyCookie = httpOnlyCookie;\n        this.cookieSameSite = CookieSameSite.valueOf(cookieSameSite);\n        this.cookiePath = cookiePath;\n        this.maxAgeSeconds = maxAgeSeconds;\n        this.cookieDomain = cookieDomain;\n        try {\n            if (encryptionKey == null) {\n                this.secretKey = KeyGenerator.getInstance(\"AES\").generateKey();\n            } else if (encryptionKey.length() < 16) {\n                throw new RuntimeException(\"Shared keys for persistent logins must be more than 16 characters long\");\n            } else {\n                MessageDigest sha256 = MessageDigest.getInstance(\"SHA-256\");\n                sha256.update(encryptionKey.getBytes(StandardCharsets.UTF_8));\n                this.secretKey = new SecretKeySpec(sha256.digest(), \"AES\");\n            }\n        } catch (Exception t) {\n            throw new RuntimeException(t);\n        }\n    }\n\n    public RestoreResult restore(RoutingContext context) {\n        return restore(context, cookieName);\n    }\n\n    public RestoreResult restore(RoutingContext context, String cookieName) {\n        Cookie existing = context.request().getCookie(cookieName);\n        // If there is no credential cookie, we have nothing to restore.\n        if (existing == null) {","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/PersistentLoginManager.java#L41-L77","documentation":"PersistentLoginManager encrypts persistent login cookies with AES. A configured encryption key shorter than 16 characters is rejected with a RuntimeException because short keys provide insufficient entropy for the SHA-256-derived AES key.","triggerScenarios":"Setting quarkus.http.auth.session.encryption-key (or the persistent login encryption key) to a string shorter than 16 characters while form-based persistent login is enabled.","commonSituations":"Dev/test keys like 'secret' or 'changeme' left in configuration, or keys truncated during copy-paste/environment variable substitution.","solutions":["Set an encryption key of at least 16 characters (longer is better, e.g. 32+ random chars).","Generate a key with openssl rand -base64 32 and place it in the config.","Keep null to have a random key generated (note: not durable across restarts)."],"exampleFix":"// before\nquarkus.http.auth.session.encryption-key=short\n// after\nquarkus.http.auth.session.encryption-key=rT7kPq2vXmN4bC8dF1gH3jL5zA9wEyU0","handlingStrategy":"validation","validationCode":"String key = config.getValue(\"quarkus.http.auth.session.encryption-key\", String.class);\nif (key != null && key.length() < 16) {\n  throw new IllegalStateException(\"encryption-key must be at least 16 characters\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate keys with openssl rand -base64 32","Never commit short placeholder keys","Check key length in a startup/config test"],"tags":["quarkus","security","encryption-key","configuration"],"backgroundTag":"encryption-key-too-short","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}