From d4deac643dfc17427e360883db0a3b82daa7a8ca Mon Sep 17 00:00:00 2001 From: chrisfu Date: Wed, 6 May 2026 17:02:17 -0400 Subject: [PATCH] fix(oauth2-proxy): use openssl rand -base64 24 for cookie secret (32 chars = 32 bytes AES-valid) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit openssl rand -base64 32 produces a 44-char string; oauth2-proxy treats it as 44 raw bytes and rejects it. -base64 24 encodes 24 bytes → 32 base64 chars with no padding, which satisfies the 32-byte AES requirement. --- etc/fetch_prole_secrets.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/etc/fetch_prole_secrets.sh b/etc/fetch_prole_secrets.sh index e302ccc..3e2d10c 100755 --- a/etc/fetch_prole_secrets.sh +++ b/etc/fetch_prole_secrets.sh @@ -10,7 +10,7 @@ # # Cookie secret: # If already stored as field 'cookie_secret' in db-prole-org, uses that. -# Otherwise generates a new 32-byte base64 secret, writes it to +# Otherwise generates a 32-char base64 secret (openssl rand -base64 24 → 32 chars = 32 bytes, valid for AES), writes it to # etc/secrets/oauth2-proxy-cookie-secret-prole, and saves it back to the # db-prole-org item so it's durable in 1Password. # @@ -78,7 +78,7 @@ COOKIE_SECRET="$(op item get "db-prole-org" --fields label=cookie_secret --revea if [[ -z "$COOKIE_SECRET" ]]; then log " No cookie_secret field in db-prole-org — generating new 32-byte secret ..." - COOKIE_SECRET="$(openssl rand -base64 32)" + COOKIE_SECRET="$(openssl rand -base64 24)" log " Saving cookie_secret back to db-prole-org in 1Password ..." op item edit "db-prole-org" \