Bug: Secret string must be provided error on new deployment

[Nomsplease]

Issue Description

Deploying this based on Docker Compose within my Kubernetes cluster, and I cannot get the login page to load.

I have dug through issues here trying to find tips, but have been unable to find anything useful. This is a new deployment with the config below. In the console and API logs, I receive the error message "Secret string must be provided." This seems to stem directly from Node, as the error is not present in any source file.

{
    "config_name": "local",
    "env": "production",
    "nginx_mode": true,
    "server_id": "puter",
    "http_port": "4100",
    "domain": "localhost",
    "allow_nipio_domains": true,
    "protocol": "http",
    "contact_email": "REDACTED",
    "services": {
        "database": {
            "engine": "sqlite",
            "path": "puter-database.sqlite"
        },
        "thumbnails": {
            "engine": "purejs"
        },
        "file-cache": {
            "disk_limit": 16384,
            "disk_max_size": 16384,
            "precache_size": 16384,
            "path": "./file-cache"
        }
    },
    "cookie_name": "REDACTED",
    "jwt_secret": "REDACTED",
    "url_signature_secret": "REDACTED",
    "private_uid_secret": "REDACTED",
    "private_uid_namespace": "REDACTED",
    "": null
}

Alert Error log

ALERT api_error_handler :: Secret string must be provided. (1)
started: 2025-09-23T14:57:27.618Z
short id: awesome-soap-5040
original id: api_error_handler
severity: critical
message: Secret string must be provided.
fields: {"error":"TypeError: Secret string must be provided.\n    at exports.unsign (/opt/puter/app/node_modules/cookie-signature/index.js:38:40)\n    at signedCookie (/opt/puter/app/node_modules/cookie-parser/index.js:143:25)\n    at signedCookies (/opt/puter/app/node_modules/cookie-parser/index.js:173:11)\n    at cookieParser (/opt/puter/app/node_modules/cookie-parser/index.js:64:27)\n    at Layer.handle [as handle_request] (/opt/puter/app/node_modules/express/lib/router/layer.js:95:5)\n    at trim_prefix (/opt/puter/app/node_modules/express/lib/router/index.js:328:13)\n    at /opt/puter/app/node_modules/express/lib/router/index.js:286:9\n    at Function.process_params (/opt/puter/app/node_modules/express/lib/router/index.js:346:12)\n    at next (/opt/puter/app/node_modules/express/lib/router/index.js:280:10)\n    at jsonParser (/opt/puter/app/node_modules/body-parser/lib/types/json.js:113:7)\n    at Layer.handle [as handle_request] (/opt/puter/app/node_modules/express/lib/router/layer.js:95:5)\n    at trim_prefix (/opt/puter/app/node_modules/express/lib/router/index.js:328:13)\n    at /opt/puter/app/node_modules/express/lib/router/index.js:286:9\n    at Function.process_params (/opt/puter/app/node_modules/express/lib/router/index.js:346:12)\n    at next (/opt/puter/app/node_modules/express/lib/router/index.js:280:10)\n    at /opt/puter/app/src/backend/src/modules/web/WebServerService.js:502:13\n    at Layer.handle [as handle_request] (/opt/puter/app/node_modules/express/lib/router/layer.js:95:5)\n    at trim_prefix (/opt/puter/app/node_modules/express/lib/router/index.js:328:13)\n    at /opt/puter/app/node_modules/express/lib/router/index.js:286:9\n    at Function.process_params (/opt/puter/app/node_modules/express/lib/router/index.js:346:12)\n    at Immediate.next (/opt/puter/app/node_modules/express/lib/router/index.js:280:10)\n    at Immediate.<anonymous> (/opt/puter/app/node_modules/express/lib/router/index.js:646:15)\n    at process.processImmediate (node:internal/timers:493:21)\n    at process.topLevelDomainCallback (node:domain:161:15)\n    at process.callbackTrampoline (node:internal/async_hooks:128:24)","url":"'/'","method":"'GET'","body":"{}","headers":"{\n  host: 'localhost:4100',\n  connection: 'keep-alive',\n  'cache-control': 'max-age=0',\n  'sec-ch-ua': '\"Chromium\";v=\"140\", \"Not=A?Brand\";v=\"24\", \"Google Chrome\";v=\"140\"',\n  'sec-ch-ua-mobile': '?0',\n  'sec-ch-ua-platform': '\"macOS\"',\n  'upgrade-insecure-requests': '1',\n  'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36',\n  accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',\n  'sec-fetch-site': 'none',\n  'sec-fetch-mode': 'navigate',\n  'sec-fetch-user': '?1',\n  'sec-fetch-dest': 'document',\n  'accept-encoding': 'gzip, deflate, br, zstd',\n  'accept-language': 'en-US,en;q=0.9',\n  cookie: 'csrftoken=qgd9BzTfABqxyxs2RIxB2J2TVb1UcQAUqjYsN4odGNI6c7a7VzVruV7zbllLBqL2; connect.sid=s%3AxWbTbdPewkJoiOOlgUxHiMy-9qRAPlMT.hCLnOokoA2B28X1Wf47s%2FyWDRQDRd8RnOjhHYrR2078'\n}"}

Deployent file is here: https://github.com/Nomsplease/Home-Ops/blob/main/kubernetes/apps/default/puter/app/helmrelease.yaml

Steps to reproduce

Deploy compose file, try to connect to localhost:4100

Expected behaviour

No response

Addition Information or Screenshots (if applicable)

No response

Deployment

• [ ] Production (puter.com)
• [ ] Development (npm run start)
• [ ] Docker (via docker run)
• [x] Docker (via docker-compose)

Puter version

No response

[KernelDeimos]

Can you confirm that the version of Puter is 2.5.1? You should be able to see this in the dev tools in your browser

I'm testing on the same commit hash as docker compose and I am not able to reproduce this issue. The error seems to come from cookie-parser and it does have a parameter called secret, but that parameter is optional.

[Nomsplease]

@KernelDeimos, the deployment is currently using the tag 2.5.1 sha256:0c5aa88f5d4db7749577b0118b16e674ff9db323604079b1b90ff6bafdcd0ab5

Screenshot of the dev tools page below. It doesn't give much. I exported a HAR file, but that also doesn't give any detail that this screenshot doesn't.

Har file: puter.har.zip

Log file as well from the container if that's of any use.

puter.log

[ArjunSaluja]

Thanks for the quick response, @KernelDeimos.

I can confirm I’m using version 2.5.1 (sha256:0c5aa88f5d4db7749577b0118b16e674ff9db323604079b1b90ff6bafdcd0ab5). The issue still occurs with this build.

All required secrets (jwt_secret, url_signature_secret, private_uid_secret, etc.) are present in my config file, but I still get the “Secret string must be provided” error.

I’ve attached the API logs and a HAR file from the browser. Let me know if any other debug info (like Node version or container setup) would help.

[KernelDeimos]

So now we have two reproductions, but I can't reproduce this issue myself using docker-compose. What I can do is summarize what I know so far:

1. Based on the line number in the stack trace, it looks like this issue is coming from cookie-parser.
2. I've confirmed that the commit hash is in fact 29834f02c0b689cdc897d98d27cc3e3b3168c56e within my contianer, which is correct for v2.5.1 stable release. (I used docker exec -it <containerid> sh and ran git log)
3. We're not passing secret to cookieParser, and it's not a required field. This error should not be possible according to their documentation.

I'm running on Archlinux with Docker docker (not Podman alias docker - maybe that makes a difference?)

If anyone that's able to reprod the issue can run this in the container (ex: using docker exec -it <containerid> sh) that would help rule out an issue of npm getting the wrong package version:

grep version /opt/puter/app/node_modules/cookie-*/package.json

My output for the above command (where I can't reproduce the issue) looks like this:

/opt/puter/app/node_modules/cookie-parser/package.json:  "version": "1.4.7",
/opt/puter/app/node_modules/cookie-signature/package.json:  "version": "1.0.6",

If your version matches but the error shows up, then we know it's not the version of cookie-parser or cookie-signature but instead... well, I don't know actually; I don't yet have any ideas after that.

[Nomsplease]

Output of cookie-parser version command:

/opt/puter/app $ grep version /opt/puter/app/node_modules/cookie-*/package.json
/opt/puter/app/node_modules/cookie-parser/package.json:  "version": "1.4.7",
/opt/puter/app/node_modules/cookie-signature/package.json:  "version": "1.0.6",

[Nomsplease]

My container is no longer giving the secret string error. I had to go back and edit my config to change my URLs again for the webpage to load correctly. This was after the secret provided error went away. The desktop is all kinds of jank, though, so I think I'm done with this project for now. I hope the self-hosting side gets better so I can revisit.

[KernelDeimos]

Okay fully acknowledged, this sucks. I don't know how you're experiencing these issues, and I've never seen the gui break like this before. I would just start from square 1 and, if you don't absolutely need the Docker image then don't use the Docker image. We've heard nothing but problems from people using Docker, and we haven't done a release to Docker in a while. Just run Puter in node.js if you can and it's a lot more likely things are going to work.

[KernelDeimos]

Alternatively if you can open developer tools in your browser while the broken gui is open and take a screenshot that would be very helpful