{"record":{"id":"0c335fe7cf43bf2a","repo":"mastra-ai/mastra","slug":"cookie-password-must-be-at-least-32-characters-for-0c335f","errorCode":null,"errorMessage":"Cookie password must be at least 32 characters for SSO. Set GOOGLE_COOKIE_PASSWORD environment variable.","messagePattern":"Cookie password must be at least 32 characters for SSO\\. Set GOOGLE_COOKIE_PASSWORD environment variable\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"auth/google/src/auth-provider.ts","lineNumber":269,"sourceCode":"      process.env.GOOGLE_COOKIE_PASSWORD ??\n      crypto.randomUUID() + crypto.randomUUID();\n\n    this.clientId = clientId;\n    this.clientSecret = clientSecret ?? null;\n    this.redirectUri = redirectUri ?? null;\n    this.scopes = options?.scopes ?? DEFAULT_SCOPES;\n    this.cookieName = options?.session?.cookieName ?? DEFAULT_COOKIE_NAME;\n    this.cookieMaxAge = options?.session?.cookieMaxAge ?? DEFAULT_COOKIE_MAX_AGE;\n    this.cookiePassword = cookiePassword;\n    this.secureCookies = options?.session?.secureCookies ?? process.env.NODE_ENV === 'production';\n    this.allowedDomains = allowedDomains;\n    this.hostedDomain = configuredHostedDomain ?? (allowedDomains.length === 1 ? allowedDomains[0] : undefined);\n    this.ssoEnabled = !!clientSecret;\n    this.jwks = createRemoteJWKSet(new URL(GOOGLE_JWKS_URL));\n\n    if (this.ssoEnabled) {\n      if (cookiePassword.length < 32) {\n        throw new Error(\n          'Cookie password must be at least 32 characters for SSO. Set GOOGLE_COOKIE_PASSWORD environment variable.',\n        );\n      }\n\n      if (!hasConfiguredCookiePassword) {\n        const message =\n          '[MastraAuthGoogle] GOOGLE_COOKIE_PASSWORD is required for Google SSO in production. Set GOOGLE_COOKIE_PASSWORD or pass session.cookiePassword.';\n        if (process.env.NODE_ENV === 'production') {\n          throw new Error(message);\n        }\n        console.warn(\n          `${message} Using an auto-generated value for development only; sessions will not survive restarts.`,\n        );\n      }\n\n      this.attachSSOProvider();\n      this.attachSessionProvider();\n    }","sourceCodeStart":251,"sourceCodeEnd":287,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/auth/google/src/auth-provider.ts#L251-L287","documentation":"When a Google client secret is configured (SSO enabled), the provider encrypts session cookies and requires a cookie password of at least 32 characters. A shorter value cannot be used because weak encryption keys make session cookies brute-forceable, so the constructor rejects it up front.","triggerScenarios":"Constructing MastraAuthGoogle with a clientSecret (or GOOGLE_CLIENT_SECRET set) while the resolved cookie password — from session.cookiePassword, options, or GOOGLE_COOKIE_PASSWORD — is a string shorter than 32 characters.","commonSituations":"Developers using a short placeholder like 'secret' or 'changeme' as GOOGLE_COOKIE_PASSWORD; copying the check from a non-SSO setup where no password is needed; local dev setups promoted to SSO-enabled environments without strengthening the secret.","solutions":["Set GOOGLE_COOKIE_PASSWORD to a string of at least 32 characters (e.g. openssl rand -base64 32).","Or pass a >=32-char value via options: new MastraAuthGoogle({ cookiePassword / session: { cookiePassword } }).","Remove the clientSecret if SSO is not intended, so the cookie password check is skipped.","Never commit the real value; rotate the stored password if a weak one was previously deployed."],"exampleFix":"// before\nGOOGLE_COOKIE_PASSWORD=changeme\n\n// after\nGOOGLE_COOKIE_PASSWORD=Kj8mQ2vX7pLw3nRtY6bC1dF5gH9jS4aZ0eU2iO8pP3xN7q","handlingStrategy":"validation","validationCode":"const pw = process.env.GOOGLE_COOKIE_PASSWORD ?? '';\nif (process.env.GOOGLE_CLIENT_SECRET && pw.length < 32) {\n  throw new Error('GOOGLE_COOKIE_PASSWORD must be at least 32 characters');\n}","typeGuard":null,"tryCatchPattern":"try {\n  const auth = new MastraAuthGoogle({ clientSecret });\n} catch (err) {\n  if (err instanceof Error && err.message.includes('Cookie password must be at least 32 characters')) {\n    console.error('Generate one with: openssl rand -base64 32');\n    process.exit(1);\n  }\n  throw err;\n}","preventionTips":["Generate cookie passwords with a CSPRNG: openssl rand -base64 32.","Add a CI/startup check that rejects short GOOGLE_COOKIE_PASSWORD values.","Treat the cookie password as a secret: store in a secret manager, never in git.","If you don't need SSO, don't set a client secret — the requirement only applies when SSO is enabled."],"tags":["configuration","security","cookie","encryption","sso"],"backgroundTag":"weak-secret-configuration","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}