Fix ActiveSupport::MessageEncryptor::InvalidMessage: ActiveSupport::MessageEncryptor::InvalidMessage in Rails

This error occurs when Rails cannot decrypt an encrypted message, usually because the secret_key_base has changed or the encrypted data is corrupted. This affects encrypted cookies, sessions, and credentials. Ensure your secret_key_base is consistent across deployments and environments, and re-encrypt any data if the key has been rotated.

Reading the Stack Trace

Here's what each line means:

• activesupport (7.1.3) lib/active_support/message_encryptor.rb:206:in `_decrypt': The decryption operation fails because the key does not match the one used to encrypt the data.
• activesupport (7.1.3) lib/active_support/messages/rotator.rb:22:in `decrypt_and_verify': The message rotator tries all configured keys but none can decrypt the message.
• app/controllers/application_controller.rb:12:in `current_user': The application tries to read the encrypted session to find the current user.

Common Causes

# config/secrets.yml or credentials
# Production used key 'abc123' to encrypt sessions
# After redeployment, key changed to 'xyz789'
# All existing user sessions are now invalid

# Server 1: RAILS_MASTER_KEY=key_one
# Server 2: RAILS_MASTER_KEY=key_two
# Encrypted cookies from server 1 cannot be read by server 2

class User < ApplicationRecord
  encrypts :ssn
end

# Direct SQL update corrupted the encrypted value:
# UPDATE users SET ssn = 'not_encrypted_value' WHERE id = 1

The Fix

Ensure all servers use the same RAILS_MASTER_KEY environment variable or config/master.key file. For key rotation, configure previous keys so Rails can still decrypt data encrypted with old keys while encrypting new data with the current key.

# Different RAILS_MASTER_KEY on each server
# Server 1: RAILS_MASTER_KEY=abc123
# Server 2: RAILS_MASTER_KEY=xyz789

# Ensure consistent RAILS_MASTER_KEY across all servers
# Set via environment variable:
# export RAILS_MASTER_KEY=abc123def456ghi789

# Or use config/master.key file (git-ignored):
# echo 'abc123def456ghi789' > config/master.key

# For key rotation, configure old keys:
# config/initializers/encryption.rb
Rails.application.config.active_record.encryption.previous = [
  { primary_key: ENV['OLD_PRIMARY_KEY'] }
]

Testing the Fix

require 'rails_helper'

RSpec.describe 'Encryption' do
  describe 'session handling' do
    it 'handles invalid session gracefully' do
      get '/dashboard', headers: {
        'Cookie' => 'session=corrupted_data_here'
      }
      expect(response).to redirect_to(new_session_path)
    end
  end

  describe User, type: :model do
    it 'encrypts and decrypts ssn' do
      user = User.create!(name: 'Test', ssn: '123-45-6789')
      expect(user.reload.ssn).to eq('123-45-6789')
    end
  end
end

Run your tests:

bundle exec rspec spec/integration/encryption_spec.rb

Pushing Through CI/CD

git checkout -b fix/rails-encryption-key,git add config/initializers/encryption.rb,git commit -m "fix: configure encryption key rotation for consistent decryption",git push origin fix/rails-encryption-key

Your CI config should look something like this:

name: CI
on:
  pull_request:
    branches: [main]
jobs:
  test:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_PASSWORD: postgres
        ports: ['5432:5432']
    env:
      RAILS_MASTER_KEY: ${{ secrets.RAILS_MASTER_KEY }}
    steps:
      - uses: actions/checkout@v4
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.3'
          bundler-cache: true
      - run: bin/rails db:setup
      - run: bundle exec rspec

The Full Manual Process: 18 Steps

Here's every step you just went through to fix this one bug:

1. Notice the error alert or see it in your monitoring tool
2. Open the error dashboard and read the stack trace
3. Identify the file and line number from the stack trace
4. Open your IDE and navigate to the file
5. Read the surrounding code to understand context
6. Reproduce the error locally
7. Identify the root cause
8. Write the fix
9. Run the test suite locally
10. Fix any failing tests
11. Write new tests covering the edge case
12. Run the full test suite again
13. Create a new git branch
14. Commit and push your changes
15. Open a pull request
16. Wait for code review
17. Merge and deploy to production
18. Monitor production to confirm the error is resolved

Total time: 30-60 minutes. For one bug.

gem install bugstack

require 'bugstack'

Bugstack.init(api_key: ENV['BUGSTACK_API_KEY'])

Deploying the Fix (Manual Path)

1. Ensure RAILS_MASTER_KEY is set consistently on all servers.
2. Configure previous keys for rotation if the key has changed.
3. Test encryption and decryption with the new configuration.
4. Open a pull request.
5. Merge and verify session handling across all servers.

Frequently Asked Questions