{"id":"7ba434ff9764e024","repo":"gofiber/fiber","slug":"failed-to-base64-decode-key-w","errorCode":null,"errorMessage":"failed to base64-decode key: %w","messagePattern":"failed to base64-decode key: %w","errorType":"http","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"middleware/encryptcookie/utils.go","lineNumber":23,"sourceCode":"\t\"crypto/cipher\"\n\t\"crypto/rand\"\n\t\"encoding/base64\"\n\t\"errors\"\n\t\"fmt\"\n\t\"slices\"\n)\n\nvar (\n\tErrInvalidKeyLength      = errors.New(\"encryption key must be 16, 24, or 32 bytes\")\n\tErrInvalidEncryptedValue = errors.New(\"encrypted value is not valid\")\n)\n\n// decodeKey decodes the provided base64-encoded key and validates its length.\n// It returns the decoded key bytes or an error when invalid.\nfunc decodeKey(key string) ([]byte, error) {\n\tkeyDecoded, err := base64.StdEncoding.DecodeString(key)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to base64-decode key: %w\", err)\n\t}\n\n\tkeyLen := len(keyDecoded)\n\tif keyLen != 16 && keyLen != 24 && keyLen != 32 {\n\t\treturn nil, ErrInvalidKeyLength\n\t}\n\n\treturn keyDecoded, nil\n}\n\n// validateKey checks if the provided base64-encoded key is of valid length.\nfunc validateKey(key string) error {\n\t_, err := decodeKey(key)\n\treturn err\n}\n\n// EncryptCookie Encrypts a cookie value with specific encryption key\nfunc EncryptCookie(name, value, key string) (string, error) {","sourceCodeStart":5,"sourceCodeEnd":41,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/encryptcookie/utils.go#L5-L41","documentation":"Thrown at middleware/encryptcookie/utils.go:23 inside decodeKey() when base64.StdEncoding.DecodeString(key) fails for the configured encryption key. The middleware requires the Key to be base64 (standard encoding) of 16, 24, or 32 raw bytes; any deviation in encoding, padding, or alphabet triggers this before any crypto runs.","triggerScenarios":"EncryptCookie or DecryptCookie is called with a Key that is not valid standard-base64: a raw-ASCII key, a hex-encoded key, a URL-safe-base64 (- and _ instead of + and /) key, missing/wrong padding, or a key with stray whitespace/newlines.","commonSituations":"Operator set COOKIE_ENCRYPTION_KEY to a raw passphrase instead of GenerateKey output; CI/CD injected the key via an env var that trimmed padding or translated characters; key was generated with base64.URLEncoding instead of StdEncoding; copy-paste introduced a newline.","solutions":["Generate the key with encryptcookie.GenerateKey(16|24|32) which returns valid standard-base64 and use that exact string verbatim.","If you already have raw key bytes, encode them yourself with base64.StdEncoding.EncodeToString(rawKey) before passing as Key.","Trim stray whitespace/newlines from the key before passing it (e.g. strings.TrimSpace on the env var).","If your key is URL-safe base64, re-encode it to standard base64 or translate -/_ to +//.","Call encryptcookie.ValidateKey(key) at startup to fail fast with a clear message instead of at the first request."],"exampleFix":"// before: raw passphrase fails base64 decode\nkey := \"my-secret-passphrase\" // not base64 -> error 157\napp.Use(encryptcookie.New(encryptcookie.Config{ Key: key }))\n\n// after: generate once, store the base64 string in secrets\n// key := encryptcookie.GenerateKey(32) // run once, persist output\nkey := os.Getenv(\"COOKIE_KEY\") // e.g. \"gm...k=\" from GenerateKey\nif err := encryptcookie.ValidateKey(key); err != nil {\n    log.Fatalf(\"bad cookie key: %v\", err)\n}\napp.Use(encryptcookie.New(encryptcookie.Config{ Key: strings.TrimSpace(key) }))","handlingStrategy":"validation","validationCode":"// Fail fast at startup: validate key encoding and length before serving traffic.\nkey := strings.TrimSpace(os.Getenv(\"COOKIE_ENCRYPTION_KEY\"))\nif err := encryptcookie.ValidateKey(key); err != nil {\n    log.Fatalf(\"invalid cookie encryption key: %v\", err)\n}\napp.Use(encryptcookie.New(encryptcookie.Config{ Key: key }))","typeGuard":"// Confirm the key is well-formed standard base64 of an AES-compatible length.\nfunc isValidCookieKey(s string) bool {\n    raw, err := base64.StdEncoding.DecodeString(s)\n    if err != nil { return false }\n    switch len(raw) {\n    case 16, 24, 32: return true\n    }\n    return false\n}","tryCatchPattern":"enc, err := encryptcookie.EncryptCookie(name, value, key)\nif err != nil {\n    if strings.Contains(err.Error(), \"base64-decode key\") {\n        // config bug - fail loudly, do not serve requests with a bad key\n        log.Fatalf(\"cookie key is not valid base64; regenerate with encryptcookie.GenerateKey\")\n    }\n    return err\n}","preventionTips":["Generate keys with encryptcookie.GenerateKey(16|24|32) and persist the base64 output.","Store keys in a secrets manager; never type raw passphrases into config.","Trim whitespace from env-var-provided keys before use.","If your key is URL-safe base64, re-encode to standard base64 (or translate -/_ to +//).","Call encryptcookie.ValidateKey at startup to fail fast."],"tags":["encryptcookie","config","base64","crypto","fiber"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}