{"id":"d43dbc9255f8b9fc","repo":"gofiber/fiber","slug":"encryption-key-must-be-16-24-or-32-bytes","errorCode":null,"errorMessage":"encryption key must be 16, 24, or 32 bytes","messagePattern":"encryption key must be 16, 24, or 32 bytes","errorType":"validation","errorClass":"ErrInvalidKeyLength","httpStatus":null,"severity":"critical","filePath":"middleware/encryptcookie/utils.go","lineNumber":14,"sourceCode":"package encryptcookie\n\nimport (\n\t\"crypto/aes\"\n\t\"crypto/cipher\"\n\t\"crypto/rand\"\n\t\"encoding/base64\"\n\t\"errors\"\n\t\"fmt\"\n\t\"slices\"\n)\n\nvar (\n\tErrInvalidKeyLength      = errors.New(\"encryption key must be 16, 24, or 32 bytes\")\n\tErrInvalidEncryptedValue = errors.New(\"encrypted value is not valid\")\n)\n\n// decodeKey decodes the provided base64-encoded key and validates its length.\n// It returns the decoded key bytes or an error when invalid.\nfunc decodeKey(key string) ([]byte, error) {\n\tkeyDecoded, err := base64.StdEncoding.DecodeString(key)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to base64-decode key: %w\", err)\n\t}\n\n\tkeyLen := len(keyDecoded)\n\tif keyLen != 16 && keyLen != 24 && keyLen != 32 {\n\t\treturn nil, ErrInvalidKeyLength\n\t}\n\n\treturn keyDecoded, nil\n}","sourceCodeStart":1,"sourceCodeEnd":32,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/encryptcookie/utils.go#L1-L32","documentation":"Returned by encryptcookie.decodeKey (utils.go:28) when the base64-decoded key is not exactly 16, 24, or 32 bytes — the only valid AES key sizes (AES-128, AES-192, AES-256). The key is expected to be base64-encoded; after decoding, the raw byte length must match an AES key size. Both EncryptCookie and DecryptCookie call decodeKey first, so the error surfaces on the first encrypt/decrypt operation.","triggerScenarios":"Configuring encryptcookie.Config.Key with a base64 string that decodes to a wrong length — e.g. a random 20-byte key, a raw ASCII string instead of base64-encoded bytes, or a truncated/padded value. GenerateKey(length) also panics with this error if given an invalid length.","commonSituations":"Pasting a plain text string as the key instead of base64-encoded bytes; generating a key with the wrong byte count; environment variable truncation; confusion between the base64 string length (e.g. 24 chars for 16 bytes) and the raw byte length; rotating keys and using a new value of the wrong size.","solutions":["Generate a valid key with encryptcookie.GenerateKey(32) (AES-256) and use the returned base64 string as Config.Key.","If you have a raw key, base64-encode it and confirm it decodes to 16/24/32 bytes.","Load the key from an environment variable and validate it at startup with encryptcookie.ValidateKey(key) before the server starts."],"exampleFix":"// before — raw string, wrong length\napp.Use(encryptcookie.New(encryptcookie.Config{\n  Key: \"my-secret-key\",\n}))\n// after — base64-encoded 32-byte key\nkey := encryptcookie.GenerateKey(32)\napp.Use(encryptcookie.New(encryptcookie.Config{\n  Key: key,\n}))","handlingStrategy":"validation","validationCode":"// Validate the key at startup before serving traffic\nkey := os.Getenv(\"ENCRYPT_COOKIE_KEY\")\nif err := encryptcookie.ValidateKey(key); err != nil {\n    log.Fatalf(\"invalid cookie encryption key: %v\", err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always generate keys with encryptcookie.GenerateKey(32).","Store the key in an environment variable and validate it at startup.","Never hand-type or abbreviate the key; copy the full base64 string."],"tags":["encryptcookie","crypto","configuration","aes","cookies"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}