I have a problem with OIDC. I am getting the following error in the browser when I try to sign in with google, or link a google account:

{
  "id": "da42871f-ccfb-413d-be59-ba98c0323ff6",
  "error": {
    "code": 500,
    "status": "Internal Server Error",
    "message": "securecookie: error - caused by: crypto/aes: invalid key size 35"
  },
  "created_at": "2025-03-12T16:37:08.920426Z",
  "updated_at": "2025-03-12T16:37:08.920426Z"
}

Looking at my kratos.yml the relevant snippet is currently:

secrets:
  cookie:
    - 7VPgn1v59aVrjlOeOVZy+ZSP/oSsXQ==
    - PLEASE-CHANGE-ME-I-AM-VERY-INSECURE
  cipher:
    - VZ3Oi1l5Tbj9xFXxZoYR7DDA6Vng/Q==
    - 32-LONG-SECRET-NOT-SECURE-AT-ALL

ciphers:
  algorithm: xchacha20-poly1305

So it should be using xchacha20 rather than AES, and the key is 32 long... so where is the error coming from? I can see the following lines in the kratos log journal, but I don't know what to do next.

Mar 12 16:50:57 ip-10-0-1-213 kratos[111802]: time=2025-03-12T16:50:57Z level=error msg=An error occurred and is being forwarded to the error user interface. audience=application error=map[message:securecookie: error - caused by: crypto/aes: invalid key size 35 stack_trace:
Mar 12 16:50:57 ip-10-0-1-213 kratos[111802]: <http://github.com/ory/kratos/x.SessionPersistValues|github.com/ory/kratos/x.SessionPersistValues>
Mar 12 16:50:57 ip-10-0-1-213 kratos[111802]:         /project/x/cookie.go:22
Mar 12 16:50:57 ip-10-0-1-213 kratos[111802]: <http://github.com/ory/kratos/continuity.(*ManagerCookie).Pause|github.com/ory/kratos/continuity.(*ManagerCookie).Pause>
Mar 12 16:50:57 ip-10-0-1-213 kratos[111802]:         /project/continuity/manager_cookie.go:64
Mar 12 16:50:57 ip-10-0-1-213 kratos[111802]: <http://github.com/ory/kratos/selfservice/strategy/oidc.(*Strategy).initLinkProvider|github.com/ory/kratos/selfservice/strategy/oidc.(*Strategy).initLinkProvider>
Mar 12 16:50:57 ip-10-0-1-213 kratos[111802]:         /project/selfservice/strategy/oidc/strategy_settings.go:380
Mar 12 16:50:57 ip-10-0-1-213 kratos[111802]: <http://github.com/ory/kratos/selfservice/strategy/oidc.(*Strategy).Settings|github.com/ory/kratos/selfservice/strategy/oidc.(*Strategy).Settings>
Mar 12 16:50:57 ip-10-0-1-213 kratos[111802]:         /project/selfservice/strategy/oidc/strategy_settings.go:312
Mar 12 16:50:57 ip-10-0-1-213 kratos[111802]: <http://github.com/ory/kratos/selfservice/flow/settings.(*Handler).updateSettingsFlow|github.com/ory/kratos/selfservice/flow/settings.(*Handler).updateSettingsFlow>
Mar 12 16:50:57 ip-10-0-1-213 kratos[111802]:         /project/selfservice/flow/settings/handler.go:595
Mar 12 16:50:57 ip-10-0-1-213 kratos[111802]: <http://github.com/ory/kratos/selfservice/flow/settings.(*Handler).RegisterPublicRoutes.(*Handler).IsAuthenticated.func7|github.com/ory/kratos/selfservice/flow/settings.(*Handler).RegisterPublicRoutes.(*Handler).IsAuthenticated.func7>
Mar 12 16:50:57 ip-10-0-1-213 kratos[111802]:         /project/session/handler.go:853
Mar 12 16:50:57 ip-10-0-1-213 kratos[111802]: <http://github.com/ory/kratos/x.(*RouterPublic).POST.NoCacheHandle.func1|github.com/ory/kratos/x.(*RouterPublic).POST.NoCacheHandle.func1>
Mar 12 16:50:57 ip-10-0-1-213 kratos[111802]:         /project/x/nocache.go:21
Mar 12 16:50:57 ip-10-0-1-213 kratos[111802]: <http://github.com/ory/kratos/x.(*RouterPublic).Handle.NoCacheHandle.func1|github.com/ory/kratos/x.(*RouterPublic).Handle.NoCacheHandle.func1>
Mar 12 16:50:57 ip-10-0-1-213 kratos[111802]:         /project/x/nocache.go:21
Mar 12 16:50:57 ip-10-0-1-213 kratos[111802]: <http://github.com/julienschmidt/httprouter.(*Router).ServeHTTP|github.com/julienschmidt/httprouter.(*Router).ServeHTTP>

I'm not sure why it is using aes or if the error is just deceiving, but xchacha20-poly1305 keys need to be 32 byte

thanks @steep-lamp-91158. So my issue is with encryption of a session cookie? But everything else apart from the OIDC google account linking and google signup works. I can login using password, passkey, code, or account recovery. And get a valid session with an ory_kratos_session cookie. So I am very lost.

hm I'm not sure, somehow it looks like it falls back to the

PLEASE-CHANGE-ME-I-AM-VERY-INSECURE

secret which is 35 characters long

Wow, progress. Thank you! I removed the new secrets leaving only the insecure default 35 character long cookie secret, and the default insecure cipher secret, cleared the browser cookies and stopped and started kratos service. And I have just linked my google account to my kratos identity. Thanks for pointing me in the right direction. I'll do a bit more exploring to try to rotate out the cookie secret and then see if I can narrow down where that error came from. It does indeed seem like my attempt to cycle the secrets caused the issue. The error message doesn't seem to correlate with the facts, so I'll try and pin down the root cause a bit more..

interesting, did you also try two secrets that are 32 characters long? not sure why the 35 one even works in the first place 😅