ory/hydra · error

cookiex: cannot marshal cookie value

Error message

cookiex: cannot marshal cookie value

What it means

Returned by sealLegacy when marshaling the value map into the legacy securecookie format fails before encoding. The payload T (or its legacy map[string]interface{} projection) contains a type the legacy codec cannot serialize, e.g. non-string values or pointer fields producing nulls that the bridge coerces.

Source

Thrown at oryx/cookiex/legacy_securecookie.go:118

}

// WithLegacyEncode makes Set seal in the legacy securecookie format under the
// first legacy key pair, so pods that only understand the legacy format can
// read freshly minted cookies during a rolling deploy. Requires
// WithLegacyKeyPairs. This is stage 1 of the rollout; a follow-up removes the
// option, flipping encoding to the v1 format. JSON null values inside the
// payload are coerced to empty strings by the bridge; do not use pointer-typed
// fields while legacy encode is enabled.
func WithLegacyEncode() Option {
	return func(c *config) { c.legacyEncode = true }
}

// sealLegacy bridges T through its JSON representation into the flat
// string-to-string map that the securecookie stores used.
func (c *Codec[T]) sealLegacy(name string, value T) (string, error) {
	buf, err := json.Marshal(value)
	if err != nil {
		return "", errors.Wrap(err, "cookiex: cannot marshal cookie value")
	}
	var flat map[string]string
	if err := json.Unmarshal(buf, &flat); err != nil {
		return "", errors.Wrap(err, "cookiex: payload must be a flat JSON object with string values while legacy encode is enabled")
	}
	if flat == nil {
		return "", errors.New("cookiex: payload must be a flat JSON object with string values while legacy encode is enabled")
	}
	values := make(map[any]any, len(flat))
	for k, v := range flat {
		values[k] = v
	}
	encoded, err := securecookie.EncodeMulti(name, values, c.legacy.codecs[0])
	if err != nil {
		return "", errors.Wrap(err, "cookiex: cannot encode legacy cookie")
	}
	return encoded, nil
}

View on GitHub (pinned to 4174065ffb)

Solutions

1. Use plain string-valued fields in the cookie payload while legacy encode is enabled
2. Avoid pointer-typed and null-producing fields, as documented on WithLegacyEncode
3. If the payload cannot be simplified, disable legacy encode once the rolling deploy completes

When it happens

Trigger: Thrown at oryx/cookiex/legacy_securecookie.go:118 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/f6b2c5acf3bcef1f. Report an issue: GitHub.