rwf2/Rocket · critical · rocket::error::Error

InsecureSecretKey

InsecureSecretKey

Error message

insecure secret key config

What it means

Ignition error from Rocket::ignite (core/lib/src/rocket.rs): when the 'secrets' feature is enabled (required for private cookies), Rocket refuses to start if secret_key is not provided and the active config profile is not the debug profile. Since private cookies signed with the zero/default key are forgeable, running a non-debug profile without an explicit key is treated as a fatal configuration error (ErrorKind::InsecureSecretKey). In debug profile a key is auto-generated, but only for local development.

Source

Thrown at core/lib/src/rocket.rs:549

    ///     assert_eq!(rocket.state::<String>().unwrap(), "managed string");
    ///
    ///     Ok(())
    /// }
    /// ```
    pub async fn ignite(mut self) -> Result<Rocket<Ignite>, Error> {
        self = Fairings::handle_ignite(self).await;
        self.fairings.audit().map_err(|f| ErrorKind::FailedFairings(f.to_vec()))?;

        // Extract the configuration; initialize default trace subscriber.
        #[allow(unused_mut)]
        let mut config = Config::try_from(&self.figment).map_err(ErrorKind::Config)?;
        crate::trace::init(&config);

        // Check for safely configured secrets.
        #[cfg(feature = "secrets")]
        if !config.secret_key.is_provided() {
            if config.profile != Config::DEBUG_PROFILE {
                return Err(Error::new(ErrorKind::InsecureSecretKey(config.profile.clone())));
            }

            if config.secret_key.is_zero() {
                config.secret_key = crate::config::SecretKey::generate()
                    .unwrap_or_else(crate::config::SecretKey::zero);
            }
        }

        // Initialize the router; check for collisions.
        let mut router = Router::new();
        self.routes.clone().into_iter().for_each(|r| router.routes.push(r));
        self.catchers.clone().into_iter().for_each(|c| router.catchers.push(c));
        let router = router.finalize()
            .map_err(|(r, c)| ErrorKind::Collisions { routes: r, catchers: c, })?;

        // Finally, freeze managed state for faster access later.
        self.state.freeze();

View on GitHub (pinned to 3a54d079ae)

Solutions

1. Set a real key: generate with `rocket secret` and put it in Rocket.toml ([default] secret_key = "...") or export ROCKET_SECRET_KEY
2. For production, load it from your secret manager and provide via env var (ROCKET_SECRET_KEY) rather than committing it
3. If it's intentional (e.g. staging without secrets), set an actual key anyway — a zero key makes private cookies forgeable
4. Verify the active profile: ROCKET_PROFILE defaults to debug locally but deployments often set release

Example fix

# before
$ ROCKET_PROFILE=release ./myapp  # secrets feature enabled, no key
Error: insecure secret key config

# after
$ ROCKET_SECRET_KEY=$(rocket secret) ROCKET_PROFILE=release ./myapp
# or Rocket.toml:
# [release]
# secret_key = "hPRYyVRiMyxpw5sBBPRXykN1DRjOXedX7 pruBJAeaYU="

// fail fast in main before ignite if secrets are required but missing
fn ensure_secret_key() {
    #[cfg(feature = "secrets")]
    if std::env::var("ROCKET_SECRET_KEY").map(|k| k.is_empty()).unwrap_or(true) {
        eprintln!("ROCKET_SECRET_KEY must be set when the secrets feature is enabled");
        std::process::exit(1);
    }
}

let rocket = rocket::build();
// In production, treat InsecureSecretKey as fatal and report configuration, not stack
if let Err(e) = rocket.launch().await {
    eprintln!("launch failed: {e}");
    std::process::exit(1);
}

When it happens

Trigger: Building with features = ["secrets"] and launching with profile release (or any custom/ROCKET_PROFILE non-debug value) while neither ROCKET_SECRET_KEY nor secret_key in Rocket.toml is set. The check happens in Rocket::ignite/launch before the server binds.

Common situations: Enabling private cookies for the first time and deploying with ROCKET_PROFILE=release; Docker images that drop the env var; CI smoke tests using a release build without config; upgrading where secret_key previously came from a now-missing file.

Related errors

• error reading TLS file `{source}`: {e}
• InvalidOperation
• Static
• Empty
• BadIdent

AI-assisted analysis of rwf2/Rocket@3a54d079ae (2026-08-16). Data as JSON: /api/errors/8619ea7db663ed6d. Report an issue: GitHub.