you must provide `secrets.default` for FIPS compliance

Error message

you must provide `secrets.default` for FIPS compliance

What it means

In FIPS 140 mode, the validator requires an explicit `secrets.default` value — the default secret pool used for hashing/signing. Empty `secrets.default` fails validation because FIPS mode cannot fall back to generated secrets.

Solutions

Add `secrets.default` with one or more long random strings
Rotate/set all four FIPS-required secret keys as a unit in your config management
Generate values with a FIPS-approved RNG
Disable fips140 if FIPS compliance was not intended

Example fix

// before
secrets:
  pagination: ["..."]
  cipher: ["..."]
  cookie: ["..."]
// after
secrets:
  pagination: ["..."]
  cipher: ["..."]
  cookie: ["..."]
  default: ["random-default-secret-32-chars-min"]

Defensive patterns

Strategy: validation

Validate before calling

if fipsEnabled && len(cfg.Secrets.Default) == 0 {
  return errors.New("secrets.default is required in FIPS mode")
}

Prevention

Set all four FIPS-required secret keys as a single atomic change
Validate the full config with the same validation path in staging before production rollout
Never partially migrate: enable FIPS only after secrets are provisioned

When it happens

Trigger: Startup with FIPS enabled and `secrets.default` absent/empty while the other FIPS-required secrets may or may not be set (this is the last check in the chain).

Common situations: Partially migrated FIPS configs where pagination/cipher/cookie were set but `default` was overlooked.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of ory/kratos@b86338da04 (2026-09-07). Data as JSON: /api/errors/9a5d62aeb1ceeba3. Report an issue: GitHub.

Appendix: source

Thrown at driver/config/config.go:444

	c = NewCustom(l, p, stdOutOrErr, ctxer)

	if !p.SkipValidation() {
		if err := c.validateIdentitySchemas(ctx); err != nil {
			return nil, err
		}
		if fips140.Enabled() {
			if len(p.Strings(ViperKeySecretsPagination)) == 0 {
				return nil, errors.New("you must provide `secrets.pagination` for FIPS compliance")
			}
			if len(p.Strings(ViperKeySecretsCipher)) == 0 {
				return nil, errors.New("you must provide `secrets.cipher` for FIPS compliance")
			}
			if len(p.Strings(ViperKeySecretsCookie)) == 0 {
				return nil, errors.New("you must provide `secrets.cookie` for FIPS compliance")
			}
			if len(p.Strings(ViperKeySecretsDefault)) == 0 {
				return nil, errors.New("you must provide `secrets.default` for FIPS compliance")
			}
		}
	}

	return c, nil
}

func NewCustom(l *logrusx.Logger, p *configx.Provider, stdOutOrErr io.Writer, ctxt contextx.Contextualizer) *Config {
	l.UseConfig(p)
	return &Config{l: l, p: p, c: ctxt, stdOutOrErr: stdOutOrErr}
}

func (p *Config) getIdentitySchemaValidator(ctx context.Context) (*jsonschema.Schema, error) {
	if p.identityMetaSchema == nil {
		c := jsonschema.NewCompiler()
		err := embedx.AddSchemaResources(c, embedx.IdentityMeta)
		if err != nil {
			return nil, err

View on GitHub (pinned to b86338da04)