ory/hydra · error

cookiex: cannot generate nonce

Error message

cookiex: cannot generate nonce

What it means

Returned by Codec.seal when reading from the crypto random source to generate the AEAD nonce fails. A failing system entropy source (CSPRNG) prevents sealing any cookie; the error wraps the underlying rand read error.

Source

Thrown at oryx/cookiex/cookiex.go:148

func (c *Codec[T]) seal(name string, value T) (string, error) {
	payload, err := json.Marshal(value)
	if err != nil {
		return "", errors.Wrap(err, "cookiex: cannot marshal cookie value")
	}
	plaintext, err := json.Marshal(envelope{IssuedAt: c.now().Unix(), Values: payload})
	if err != nil {
		return "", errors.Wrap(err, "cookiex: cannot marshal envelope")
	}
	a, err := aead.New(c.keys[0])
	if err != nil {
		return "", errors.Wrap(err, "cookiex: cannot create AEAD")
	}
	// The nonce is prepended to the ciphertext. AEADs that manage the nonce
	// internally report a nonce size of zero, so this also covers them.
	nonce := make([]byte, a.NonceSize())
	if _, err := rand.Read(nonce); err != nil {
		return "", errors.Wrap(err, "cookiex: cannot generate nonce")
	}
	sealed := a.Seal(nonce, nonce, plaintext, c.aad(name))
	return formatPrefix + base64.RawURLEncoding.EncodeToString(sealed), nil
}

func (c *Codec[T]) open(name, value string) (T, error) {
	var zero T
	raw, err := base64.RawURLEncoding.DecodeString(strings.TrimPrefix(value, formatPrefix))
	if err != nil {
		return zero, errors.WithStack(ErrInvalidCookie)
	}
	for _, key := range c.keys {
		a, err := aead.New(key)
		if err != nil {
			return zero, errors.Wrap(err, "cookiex: cannot create AEAD")
		}
		if len(raw) < a.NonceSize() {
			continue

View on GitHub (pinned to 4174065ffb)

Solutions

1. Check host entropy availability and the wrapped rand error
2. Retry the Set operation once in case of a transient entropy shortage
3. Treat persistent failures as a host-level problem requiring investigation

When it happens

Trigger: Thrown at oryx/cookiex/cookiex.go:148 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/2936ff25379871dc. Report an issue: GitHub.