session is expired when secrets.cookie key is rotated

[mangalaman93]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• This issue affects my Ory Cloud project.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Describe the bug

I believe the description for secrets.cookie is not accurate. The link https://www.ory.sh/docs/kratos/reference/configuration has the following description -

 ## Signing Keys for Cookies ##
  #
  # The first secret in the array is used for encrypting cookies while all other keys are used to decrypt older cookies that were signed with that old secret.
  #

whereas the keys provided in this parameter is directly passed to the function from repo https://github.com/gorilla/securecookie which accepts a pair of keys, a hash key and an encryption key.

Reproducing the bug

In order to reproduce the bug, I followed the quickstart and ran kratos with following configuration -

secrets:
  cookie:
    - PLEASE-CHANGE-ME-I-AM-VERY-INSECURE
  cipher:
    - 32-LONG-SECRET-NOT-SECURE-AT-ALL

I opened the self service UI and opened http://127.0.0.1:4455/ in my browser. I created an account and logged in.

Then, I updated the configuration to the following -

secrets:
  cookie:
    - THIS-IS-A-NEW-SECRET-IT-WONT-WORK--
    - PLEASE-CHANGE-ME-I-AM-VERY-INSECURE
  cipher:
    - 32-LONG-SECRET-NOT-SECURE-AT-ALL

The I ran the following command to restart kratos -

docker-compose -f quickstart.yml restart kratos

Then, I went to my browser again and refreshed the page. I was hoping that I will still be logged in but the page showed that login form.

I updated the configuration back to the original configuration, restarted kratos, refreshed the browser page and it showed that I was logged in again.

Relevant log output

No response

Relevant configuration

No response

Version

oryd/kratos:v0.8.0-alpha.3

On which operating system are you observing this issue?

Linux

In which environment are you deploying?

Docker Compose

Additional Context

No response

[mangalaman93]

I also wonder whether that means cookies are not encrypted if we specify just one key in the secrets.session and whether that is a problem!

[mangalaman93]

We should update the doc here too if this is accepted https://www.ory.sh/docs/kratos/guides/secret-key-rotation

[aeneasr]

Nice find man, thank you!