{"record":{"id":"fd17869e737d73df","repo":"ory/kratos","slug":"you-must-provide-secrets-cookie-for-fips-complia","errorCode":null,"errorMessage":"you must provide `secrets.cookie` for FIPS compliance","messagePattern":"you must provide `secrets\\.cookie` for FIPS compliance","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"driver/config/config.go","lineNumber":441,"sourceCode":"\t}\n\n\tl.UseConfig(p)\n\n\tc = NewCustom(l, p, stdOutOrErr, ctxer)\n\n\tif !p.SkipValidation() {\n\t\tif err := c.validateIdentitySchemas(ctx); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif fips140.Enabled() {\n\t\t\tif len(p.Strings(ViperKeySecretsPagination)) == 0 {\n\t\t\t\treturn nil, errors.New(\"you must provide `secrets.pagination` for FIPS compliance\")\n\t\t\t}\n\t\t\tif len(p.Strings(ViperKeySecretsCipher)) == 0 {\n\t\t\t\treturn nil, errors.New(\"you must provide `secrets.cipher` for FIPS compliance\")\n\t\t\t}\n\t\t\tif len(p.Strings(ViperKeySecretsCookie)) == 0 {\n\t\t\t\treturn nil, errors.New(\"you must provide `secrets.cookie` for FIPS compliance\")\n\t\t\t}\n\t\t\tif len(p.Strings(ViperKeySecretsDefault)) == 0 {\n\t\t\t\treturn nil, errors.New(\"you must provide `secrets.default` for FIPS compliance\")\n\t\t\t}\n\t\t}\n\t}\n\n\treturn c, nil\n}\n\nfunc NewCustom(l *logrusx.Logger, p *configx.Provider, stdOutOrErr io.Writer, ctxt contextx.Contextualizer) *Config {\n\tl.UseConfig(p)\n\treturn &Config{l: l, p: p, c: ctxt, stdOutOrErr: stdOutOrErr}\n}\n\nfunc (p *Config) getIdentitySchemaValidator(ctx context.Context) (*jsonschema.Schema, error) {\n\tif p.identityMetaSchema == nil {\n\t\tc := jsonschema.NewCompiler()","sourceCodeStart":423,"sourceCodeEnd":459,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/driver/config/config.go#L423-L459","documentation":"In FIPS 140 mode, the validator requires an explicit `secrets.cookie` value used to sign/encrypt cookies (e.g. session/CSRF cookies). Because FIPS constraints prevent deriving defaults, an empty `secrets.cookie` list fails config validation.","triggerScenarios":"Startup with FIPS enabled and no `secrets.cookie` key populated in config or environment.","commonSituations":"Fresh FIPS deployment where cookie secrets were previously auto-generated; config templates missing the cookie secrets stanza.","solutions":["Add `secrets.cookie` with at least one strong random string to config/env","Provide all four FIPS-required secret keys together (pagination, cipher, cookie, default)","Use a FIPS-compliant generator for the values","If FIPS was enabled unintentionally, disable fips140 mode"],"exampleFix":"// before\nsecrets:\n  cipher: [\"...\"]\n// after\nsecrets:\n  cipher: [\"...\"]\n  cookie: [\"random-cookie-signing-secret-32-chars-min\"]","handlingStrategy":"validation","validationCode":"if fipsEnabled && len(cfg.Secrets.Cookie) == 0 {\n  return errors.New(\"secrets.cookie is required in FIPS mode\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Template FIPS deployments with all secret stanzas present (possibly empty-checked in CI)","Store cookie secrets with the same rotation policy as session secrets","Document FIPS secret requirements in your infra runbook"],"tags":["config","fips","security","cookies"],"backgroundTag":"missing-required-config-field","analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}