What causes "fiber: encrypt cookie middleware requires key" in gofiber/fiber?

Generate a key with encryptcookie.GenerateKey(32) and pass it: encryptcookie.New(encryptcookie.Config{Key: key}).

fiber: encrypt cookie middleware requires key

Error message

fiber: encrypt cookie middleware requires key

What it means

The encryptcookie middleware needs a symmetric key to AES-GCM encrypt/decrypt cookie values; an empty Key is unusable. configDefault (config.go:73-75) panics when cfg.Key == "" so the app fails fast at startup instead of silently passing cookies through unencrypted.

Source

Thrown at middleware/encryptcookie/config.go:74

		if cfg.Next == nil {
			cfg.Next = ConfigDefault.Next
		}

		if cfg.Except == nil {
			cfg.Except = ConfigDefault.Except
		}

		if cfg.Encryptor == nil {
			cfg.Encryptor = ConfigDefault.Encryptor
		}

		if cfg.Decryptor == nil {
			cfg.Decryptor = ConfigDefault.Decryptor
		}
	}

	if cfg.Key == "" {
		panic("fiber: encrypt cookie middleware requires key")
	}

	if err := validateKey(cfg.Key); err != nil {
		panic(err)
	}

	return cfg
}

View on GitHub (pinned to 9a4c7e57fe)

Solutions

Generate a key with encryptcookie.GenerateKey(32) and pass it: encryptcookie.New(encryptcookie.Config{Key: key}).
Load Key from a secret manager or env var and fail app startup if it is empty before calling New.
Use the same key across all instances that share signed cookies; rotate by versioning the key.

Example fix

// before
encryptcookie.New(encryptcookie.Config{})

// after
key := os.Getenv("COOKIE_ENCRYPT_KEY")
if key == "" { log.Fatal("COOKIE_ENCRYPT_KEY not set") }
encryptcookie.New(encryptcookie.Config{Key: key})

Defensive patterns

Strategy: validation

Validate before calling

func resolveEncryptKey() string {
    k := os.Getenv("COOKIE_ENCRYPT_KEY")
    if k == "" {
        log.Fatal("COOKIE_ENCRYPT_KEY is not set; generate one with encryptcookie.GenerateKey(32)")
    }
    return k
}

cfg := encryptcookie.Config{Key: resolveEncryptKey()}

Prevention

Fail fast at startup if the key env var is empty.
Store the key in a secret manager, not in source control.
Document the key requirement in your service's README.

When it happens

Trigger: Calling encryptcookie.New(encryptcookie.Config{}) with no Key, or passing a Config whose Key field is unset (zero value ""). Common when the key is sourced from an env var that is not set in the current environment.

Common situations: Forgetting to inject the ENCRYPT_COOKIE_KEY env var in a new deploy environment, or initializing the middleware in a test without setting Key.

Related errors

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/24ac6a0db0c92139.json. Report an issue: GitHub.