you must provide `secrets.cookie` for FIPS compliance

Error message

you must provide `secrets.cookie` for FIPS compliance

What it means

In FIPS 140 mode, the validator requires an explicit `secrets.cookie` value used to sign/encrypt cookies (e.g. session/CSRF cookies). Because FIPS constraints prevent deriving defaults, an empty `secrets.cookie` list fails config validation.

Solutions

Add `secrets.cookie` with at least one strong random string to config/env
Provide all four FIPS-required secret keys together (pagination, cipher, cookie, default)
Use a FIPS-compliant generator for the values
If FIPS was enabled unintentionally, disable fips140 mode

Example fix

// before
secrets:
  cipher: ["..."]
// after
secrets:
  cipher: ["..."]
  cookie: ["random-cookie-signing-secret-32-chars-min"]

Defensive patterns

Strategy: validation

Validate before calling

if fipsEnabled && len(cfg.Secrets.Cookie) == 0 {
  return errors.New("secrets.cookie is required in FIPS mode")
}

Prevention

Template FIPS deployments with all secret stanzas present (possibly empty-checked in CI)
Store cookie secrets with the same rotation policy as session secrets
Document FIPS secret requirements in your infra runbook

When it happens

Trigger: Startup with FIPS enabled and no `secrets.cookie` key populated in config or environment.

Common situations: Fresh FIPS deployment where cookie secrets were previously auto-generated; config templates missing the cookie secrets stanza.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of ory/kratos@b86338da04 (2026-09-07). Data as JSON: /api/errors/fd17869e737d73df. Report an issue: GitHub.

Appendix: source

Thrown at driver/config/config.go:441

	}

	l.UseConfig(p)

	c = NewCustom(l, p, stdOutOrErr, ctxer)

	if !p.SkipValidation() {
		if err := c.validateIdentitySchemas(ctx); err != nil {
			return nil, err
		}
		if fips140.Enabled() {
			if len(p.Strings(ViperKeySecretsPagination)) == 0 {
				return nil, errors.New("you must provide `secrets.pagination` for FIPS compliance")
			}
			if len(p.Strings(ViperKeySecretsCipher)) == 0 {
				return nil, errors.New("you must provide `secrets.cipher` for FIPS compliance")
			}
			if len(p.Strings(ViperKeySecretsCookie)) == 0 {
				return nil, errors.New("you must provide `secrets.cookie` for FIPS compliance")
			}
			if len(p.Strings(ViperKeySecretsDefault)) == 0 {
				return nil, errors.New("you must provide `secrets.default` for FIPS compliance")
			}
		}
	}

	return c, nil
}

func NewCustom(l *logrusx.Logger, p *configx.Provider, stdOutOrErr io.Writer, ctxt contextx.Contextualizer) *Config {
	l.UseConfig(p)
	return &Config{l: l, p: p, c: ctxt, stdOutOrErr: stdOutOrErr}
}

func (p *Config) getIdentitySchemaValidator(ctx context.Context) (*jsonschema.Schema, error) {
	if p.identityMetaSchema == nil {
		c := jsonschema.NewCompiler()

View on GitHub (pinned to b86338da04)