quarkusio/quarkus · error · io.quarkus.runtime.configuration.ConfigurationException

Secret key for encrypting state cookie is less than 16 chara

Error message

Secret key for encrypting state cookie is less than 16 characters long

What it means

TenantConfigContextImpl.createStateSecretKey throws ConfigurationException when the secret used to encrypt the OIDC state cookie is shorter than 16 characters (after UTF-8 encoding). AES state cookie encryption requires at least a 16-byte secret; under 32 bytes only logs a debug warning about weaker encryption.

Source

Thrown at extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantConfigContextImpl.java:154

                if (possiblePkceSecret != null && possiblePkceSecret.length() < 32) {
                    LOG.debug("Client secret is less than 32 characters long, the state secret will be generated");
                } else {
                    stateSecret = possiblePkceSecret;
                }
            }
            try {
                if (stateSecret == null) {
                    LOG.debug("Secret key for encrypting state cookie is missing, auto-generating it");
                    SecretKey key = OidcCommonUtils.generateSecretKey();
                    return key;
                }
                byte[] secretBytes = stateSecret.getBytes(StandardCharsets.UTF_8);
                if (secretBytes.length < 32) {
                    String errorMessage = "Secret key for encrypting state cookie should be at least 32 characters long"
                            + " for the strongest state cookie encryption to be produced."
                            + " Please update 'quarkus.oidc.authentication.state-secret' or update the configured client secret.";
                    if (secretBytes.length < 16) {
                        throw new ConfigurationException(
                                "Secret key for encrypting state cookie is less than 16 characters long");
                    } else {
                        LOG.debug(errorMessage);
                    }
                }
                return new SecretKeySpec(OidcUtils.getSha256Digest(secretBytes), "AES");
            } catch (Exception ex) {
                throw new OIDCException(ex);
            }
        }
        return null;
    }

    private static SecretKey createTokenEncSecretKey(OidcTenantConfig config, OidcProvider provider, String clientOrJwtSecret) {
        if (config.tokenStateManager().encryptionRequired()) {
            String encSecret = null;
            if (config.tokenStateManager().encryptionSecret().isPresent()) {
                encSecret = config.tokenStateManager().encryptionSecret().get();

View on GitHub (pinned to e1c734241f)

Solutions

Set quarkus.oidc.authentication.state-secret to a random secret of at least 32 characters (recommended) and never less than 16
Use a longer client secret in the IdP if the client secret is the encryption source
Generate the secret securely, e.g. openssl rand -base64 32

Example fix

// before
quarkus.oidc.authentication.state-secret=short
// after
quarkus.oidc.authentication.state-secret=dGhpcy1pcy1hLTMyLWNoYXItc2VjcmV0LWtleSEhIQ==

Defensive patterns

Strategy: validation

Validate before calling

int len = secret.getBytes(StandardCharsets.UTF_8).length;
if (len < 16) throw new IllegalArgumentException("state-secret must be >= 16 chars (32 recommended), got " + len);

Try / catch

try { startApplication(); } catch (ConfigurationException e) { fail("Provide a >=32-char quarkus.oidc.authentication.state-secret"); }

Prevention

Generate secrets with openssl rand -base64 32
Keep secrets in env/vault, never hardcode short values
Check byte length (UTF-8), not just character count, for multi-byte secrets

When it happens

Trigger: Initializing tenant state cookie encryption (createStateSecretKey, called by stateCookieEncryptionKey) with a 'quarkus.oidc.authentication.state-secret' or client secret whose UTF-8 bytes are < 16; the length check throws ConfigurationException.

Common situations: Short demo secrets in production configs; short client secrets from an IdP used for encryption; truncation or encoding mistakes reducing byte length below 16 (multi-byte chars vs chars).

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/91125a884c7acf7d. Report an issue: GitHub.