SECRET_KEY is generated with incorrect length #12

New Issue

2023-04-22T22:19:34Z

3wordchant commented

2023-04-22 22:19:34 +00:00

Steps to reproduce:

abra app new outline
(enable SSO)
abra app deploy outline
Try to log in

Expected:

Works!

Actual:

Sent back to login screen, error in logs: �2023-04-22T00:11:09.611179000Z {"error":"Invalid key length","stack":"UnauthorizedError: Invalid key length\n at AuthenticationError (/opt/outline/build/server/errors.js:38:34)\n at accountProvisioner (/opt/outline/build/server/commands/accountProvisioner.js:118:43)\n at runMicrotasks (<anonymous>)\n at processTicksAndRejections (node:internal/process/task_queues:96:5)","level":"error","message":"Error during authentication"}

This seems to be because SECRET_KEY should be 32 characters, but abra generates a 64-character secret. Maybe changing to length=32 is enough?

Steps to reproduce: 1. `abra app new outline` 2. (enable SSO) 3. `abra app deploy outline` 4. Try to log in Expected: - Works! Actual: - Sent back to login screen, error in logs: `�2023-04-22T00:11:09.611179000Z {"error":"Invalid key length","stack":"UnauthorizedError: Invalid key length\n at AuthenticationError (/opt/outline/build/server/errors.js:38:34)\n at accountProvisioner (/opt/outline/build/server/commands/accountProvisioner.js:118:43)\n at runMicrotasks (<anonymous>)\n at processTicksAndRejections (node:internal/process/task_queues:96:5)","level":"error","message":"Error during authentication"}` This seems to be because SECRET_KEY should be 32 characters, but abra generates a 64-character secret. Maybe changing to `length=32` is enough?

👍 2

iexos commented

2023-05-10 10:34:06 +00:00

Changing secret_key to length 32 doesn't solve the problem for me, I still get the exact same error msg.
I also tried length=16, then I got:

{"level":"warn","message":"- SECRET_KEY's byte length must fall into (32, 64) range"}

So I guess the length of secret_key is not the issue.

Changing `secret_key` to length 32 doesn't solve the problem for me, I still get the exact same error msg. I also tried length=16, then I got: ``` {"level":"warn","message":"- SECRET_KEY's byte length must fall into (32, 64) range"} ``` So I guess the length of secret_key is not the issue.

3wordchant commented

2023-05-10 16:53:30 +00:00

@iexos maybe you tried already, but you'd need to regenerate secrets (abra app secret rm ..., abra app secret generate ...) after changing this, and possibly also drop volumes (abra app volume rm -A ...).

Are you able to check what the current length of the secret key is, e.g. abra app run <domain> app cat /run/secrets/secret_key | wc -c?

@iexos maybe you tried already, but you'd need to regenerate secrets (`abra app secret rm ...`, `abra app secret generate ...`) after changing this, and possibly also drop volumes (`abra app volume rm -A ...`). Are you able to check what the current length of the secret key is, e.g. `abra app run <domain> app cat /run/secrets/secret_key | wc -c`?

iexos commented

2023-05-10 21:34:34 +00:00

Yes i did remove and regenerate with different key sizes, and also completely removed the app. Just tried now again:

> abra app run <domain> app cat /run/secrets/secret_key | wc -c
32

Also tried reducing the utils_secret to 32 chars and upgrading to newest image outlinewiki/outline:0.69.2, no change.

I'm using Authentik, maybe this is about some key that is returned? I also tried changing the key sizes within Authentik provider, no change.

Yes i did remove and regenerate with different key sizes, and also completely removed the app. Just tried now again: ``` > abra app run <domain> app cat /run/secrets/secret_key | wc -c 32 ``` Also tried reducing the utils_secret to 32 chars and upgrading to newest image `outlinewiki/outline:0.69.2`, no change. I'm using Authentik, maybe this is about some key that is returned? I also tried changing the key sizes within Authentik provider, no change.

iexos commented

2023-05-11 12:54:19 +00:00

Got it to work now. SECRET_KEY has to be in hex format, i.e. like openssl rand -hex 32. Can abra do that?

Got it to work now. `SECRET_KEY` has to be in hex format, i.e. like `openssl rand -hex 32`. Can `abra` do that?

3wordchant commented

2023-07-08 20:35:04 +00:00

Ah great call, yes, that rings a bell. No, I think abra's current secret generation only does alphanumeric secrets - race you to a feature request in coop-cloud/organising

moritz referenced this issue from toolshed/organising

2024-05-01 11:28:47 +00:00

Secret Character Modifier #614

3wordchant commented

2025-06-24 10:17:09 +00:00

Looks like this is implemented now, shall we try it out? toolshed/organising#614

marlon commented

2025-10-14 23:37:33 +00:00

I followed the issue thread here and it looks like according to the documentation commit here:
2950d56c32 that this feature still doesn't support hex charset. If so, it still doesn't solve the need for Outline (or the Garage recipe, which is why I ended up here)

I followed the issue thread here and it looks like according to the documentation commit here: https://git.coopcloud.tech/toolshed/docs.coopcloud.tech/commit/2950d56c32e19bb9c4e59add047e6b7827e06207 that this feature still doesn't support hex charset. If so, it still doesn't solve the need for Outline (or the Garage recipe, which is why I ended up here)

decentral1se referenced this issue from toolshed/abra

2025-10-15 08:02:21 +00:00

Support hex charset for secret charset modifier #695

decentral1se commented

2025-10-15 08:02:25 +00:00

toolshed/abra#695

https://git.coopcloud.tech/toolshed/abra/issues/695

❤️ 3

Sign in to join this conversation.