{"record":{"id":"f6b2c5acf3bcef1f","repo":"ory/hydra","slug":"cookiex-cannot-marshal-cookie-value-f6b2c5","errorCode":null,"errorMessage":"cookiex: cannot marshal cookie value","messagePattern":"cookiex: cannot marshal cookie value","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/cookiex/legacy_securecookie.go","lineNumber":118,"sourceCode":"}\n\n// WithLegacyEncode makes Set seal in the legacy securecookie format under the\n// first legacy key pair, so pods that only understand the legacy format can\n// read freshly minted cookies during a rolling deploy. Requires\n// WithLegacyKeyPairs. This is stage 1 of the rollout; a follow-up removes the\n// option, flipping encoding to the v1 format. JSON null values inside the\n// payload are coerced to empty strings by the bridge; do not use pointer-typed\n// fields while legacy encode is enabled.\nfunc WithLegacyEncode() Option {\n\treturn func(c *config) { c.legacyEncode = true }\n}\n\n// sealLegacy bridges T through its JSON representation into the flat\n// string-to-string map that the securecookie stores used.\nfunc (c *Codec[T]) sealLegacy(name string, value T) (string, error) {\n\tbuf, err := json.Marshal(value)\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"cookiex: cannot marshal cookie value\")\n\t}\n\tvar flat map[string]string\n\tif err := json.Unmarshal(buf, &flat); err != nil {\n\t\treturn \"\", errors.Wrap(err, \"cookiex: payload must be a flat JSON object with string values while legacy encode is enabled\")\n\t}\n\tif flat == nil {\n\t\treturn \"\", errors.New(\"cookiex: payload must be a flat JSON object with string values while legacy encode is enabled\")\n\t}\n\tvalues := make(map[any]any, len(flat))\n\tfor k, v := range flat {\n\t\tvalues[k] = v\n\t}\n\tencoded, err := securecookie.EncodeMulti(name, values, c.legacy.codecs[0])\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"cookiex: cannot encode legacy cookie\")\n\t}\n\treturn encoded, nil\n}","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/cookiex/legacy_securecookie.go#L100-L136","documentation":"Returned by sealLegacy when marshaling the value map into the legacy securecookie format fails before encoding. The payload T (or its legacy map[string]interface{} projection) contains a type the legacy codec cannot serialize, e.g. non-string values or pointer fields producing nulls that the bridge coerces.","triggerScenarios":"Thrown at oryx/cookiex/legacy_securecookie.go:118 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use plain string-valued fields in the cookie payload while legacy encode is enabled","Avoid pointer-typed and null-producing fields, as documented on WithLegacyEncode","If the payload cannot be simplified, disable legacy encode once the rolling deploy completes"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}