{"id":"af9178e2ba2161c3","repo":"gofiber/fiber","slug":"failed-to-base64-decode-value-w","errorCode":null,"errorMessage":"failed to base64-decode value: %w","messagePattern":"failed to base64-decode value: %w","errorType":"http","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"middleware/encryptcookie/utils.go","lineNumber":70,"sourceCode":"\tgcm, err := cipher.NewGCMWithRandomNonce(block)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to create GCM mode: %w\", err)\n\t}\n\n\tciphertext := gcm.Seal(nil, nil, []byte(value), []byte(name))\n\treturn base64.StdEncoding.EncodeToString(ciphertext), nil\n}\n\n// DecryptCookie Decrypts a cookie value with specific encryption key\nfunc DecryptCookie(name, value, key string) (string, error) {\n\tkeyDecoded, err := decodeKey(key)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tenc, err := base64.StdEncoding.DecodeString(value)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to base64-decode value: %w\", err)\n\t}\n\n\tblock, err := aes.NewCipher(keyDecoded)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to create AES cipher: %w\", err)\n\t}\n\n\tgcm, err := cipher.NewGCMWithRandomNonce(block)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to create GCM mode: %w\", err)\n\t}\n\n\tif len(enc) < gcm.NonceSize()+gcm.Overhead() {\n\t\treturn \"\", ErrInvalidEncryptedValue\n\t}\n\n\tplaintext, err := gcm.Open(nil, nil, enc, []byte(name))\n\tif err != nil {","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/encryptcookie/utils.go#L52-L88","documentation":"Returned by DecryptCookie when base64.StdEncoding.DecodeString rejects the cookie value. DecryptCookie expects values produced by EncryptCookie, which emits standard base64; any value that is not valid standard-base64 triggers this. It is a wrapped encoding/base64 error.","triggerScenarios":"Calling DecryptCookie(name, value, key) where value is a plaintext cookie, URL-safe-base64 (-_ instead of +/), missing padding, truncated by a proxy, or hand-crafted by a client. The decode happens at utils.go:68-70 before any crypto runs.","commonSituations":"Migrating an app from plaintext cookies to encrypted cookies without invalidating old values; a CDN/proxy rewriting cookie characters; switching encoding std (URLEncoding vs StdEncoding); browser truncating very long cookies across domain boundaries.","solutions":["Treat a base64-decode failure as 'no valid cookie' — re-issue a fresh encrypted cookie instead of surfacing the error to the user.","Confirm every encrypted cookie was produced by EncryptCookie with the SAME base64.StdEncoding (not URLEncoding).","Verify no reverse proxy is URL-decoding/rewriting the Cookie header value in transit.","If mixing encodings, normalize the value to StdEncoding before calling DecryptCookie."],"exampleFix":"// before\nv, err := encryptcookie.DecryptCookie(name, c.Cookies(name), key)\nif err != nil { return err }\n\n// after — re-issue on any decode/decrypt failure\nv, err := encryptcookie.DecryptCookie(name, c.Cookies(name), key)\nif err != nil {\n    // stale or foreign cookie: clear and continue unauthenticated\n    c.Response().Header.Del(\"Set-Cookie\")\n    return c.Next()\n}","handlingStrategy":"try-catch","validationCode":"// cheap pre-check: standard base64, multiple of 4 chars, only valid alphabet\nfunc isValidStdBase64(s string) bool {\n    if len(s)%4 != 0 {\n        return false\n    }\n    for i := 0; i < len(s); i++ {\n        c := s[i]\n        if !((c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') ||\n            (c >= '0' && c <= '9') || c == '+' || c == '/' || c == '=') {\n            return false\n        }\n    }\n    return true\n}\n\n// usage\nraw := c.Cookies(name)\nif !isValidStdBase64(raw) {\n    // re-issue instead of attempting DecryptCookie\n    return c.Next()\n}","typeGuard":null,"tryCatchPattern":"v, err := encryptcookie.DecryptCookie(name, c.Cookies(name), key)\nif err != nil {\n    // log at debug, never expose — treat as absent cookie\n    log.Debugf(\"cookie decrypt failed: %v\", err)\n    return c.Next()\n}","preventionTips":["Always encrypt via EncryptCookie; never mix plaintext and encrypted cookies under the same name.","Standardize on base64.StdEncoding across all services sharing the cookie.","On key rotation, attempt decrypt with both old and new keys before giving up."],"tags":["crypto","cookie","base64","encryptcookie"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}