{"record":{"id":"67bcda4b07dfb128","repo":"mastra-ai/mastra","slug":"mastraauthgoogle-google-cookie-password-is-requi","errorCode":null,"errorMessage":"[MastraAuthGoogle] GOOGLE_COOKIE_PASSWORD is required for Google SSO in production. Set GOOGLE_COOKIE_PASSWORD or pass session.cookiePassword.","messagePattern":"\\[MastraAuthGoogle\\] GOOGLE_COOKIE_PASSWORD is required for Google SSO in production\\. Set GOOGLE_COOKIE_PASSWORD or pass session\\.cookiePassword\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"auth/google/src/auth-provider.ts","lineNumber":278,"sourceCode":"    this.cookiePassword = cookiePassword;\n    this.secureCookies = options?.session?.secureCookies ?? process.env.NODE_ENV === 'production';\n    this.allowedDomains = allowedDomains;\n    this.hostedDomain = configuredHostedDomain ?? (allowedDomains.length === 1 ? allowedDomains[0] : undefined);\n    this.ssoEnabled = !!clientSecret;\n    this.jwks = createRemoteJWKSet(new URL(GOOGLE_JWKS_URL));\n\n    if (this.ssoEnabled) {\n      if (cookiePassword.length < 32) {\n        throw new Error(\n          'Cookie password must be at least 32 characters for SSO. Set GOOGLE_COOKIE_PASSWORD environment variable.',\n        );\n      }\n\n      if (!hasConfiguredCookiePassword) {\n        const message =\n          '[MastraAuthGoogle] GOOGLE_COOKIE_PASSWORD is required for Google SSO in production. Set GOOGLE_COOKIE_PASSWORD or pass session.cookiePassword.';\n        if (process.env.NODE_ENV === 'production') {\n          throw new Error(message);\n        }\n        console.warn(\n          `${message} Using an auto-generated value for development only; sessions will not survive restarts.`,\n        );\n      }\n\n      this.attachSSOProvider();\n      this.attachSessionProvider();\n    }\n\n    this.registerOptions(options);\n  }\n\n  async authenticateToken(token: string, request?: MastraAuthRequest): Promise<GoogleUser | null> {\n    if (this.ssoEnabled && request) {\n      const sessionUser = await this.getUserFromSessionCookie(request);\n      if (sessionUser) return sessionUser;\n    }","sourceCodeStart":260,"sourceCodeEnd":296,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/auth/google/src/auth-provider.ts#L260-L296","documentation":"With SSO enabled, if no cookie password was explicitly configured (neither GOOGLE_COOKIE_PASSWORD nor session.cookiePassword), the provider only auto-generates a temporary one in non-production while warning. In NODE_ENV=production it throws, because an auto-generated password would invalidate all sessions on every restart and is unsafe for production.","triggerScenarios":"new MastraAuthGoogle(...) with a clientSecret configured, no GOOGLE_COOKIE_PASSWORD env var and no session.cookiePassword option, while process.env.NODE_ENV === 'production'.","commonSituations":"Deploying to a production environment where local dev worked (dev got the auto-generated value + warning) but prod fails; NODE_ENV newly set to 'production' on a host; platform env config omitting GOOGLE_COOKIE_PASSWORD while GOOGLE_CLIENT_SECRET is present.","solutions":["Set GOOGLE_COOKIE_PASSWORD (>= 32 chars) in the production environment.","Or pass session.cookiePassword in the provider options at construction.","If SSO is unintended, remove the Google client secret so the requirement disappears.","After setting it, redeploy/restart so sessions are encrypted with a stable key and survive restarts."],"exampleFix":"// before (production deploy without cookie password)\nGOOGLE_CLIENT_SECRET=...\n# GOOGLE_COOKIE_PASSWORD not set -> throws\n\n// after\nGOOGLE_CLIENT_SECRET=...\nGOOGLE_COOKIE_PASSWORD=Kj8mQ2vX7pLw3nRtY6bC1dF5gH9jS4aZ0eU2iO8pP3xN7q","handlingStrategy":"validation","validationCode":"if (process.env.NODE_ENV === 'production' && process.env.GOOGLE_CLIENT_SECRET && !process.env.GOOGLE_COOKIE_PASSWORD) {\n  throw new Error('GOOGLE_COOKIE_PASSWORD is required in production for Google SSO');\n}","typeGuard":null,"tryCatchPattern":"try {\n  const auth = new MastraAuthGoogle({ clientSecret });\n} catch (err) {\n  if (err instanceof Error && err.message.includes('GOOGLE_COOKIE_PASSWORD is required')) {\n    console.error('Configure GOOGLE_COOKIE_PASSWORD before production deploy');\n    process.exit(1);\n  }\n  throw err;\n}","preventionTips":["Set a stable, >=32-char GOOGLE_COOKIE_PASSWORD in every production-like environment.","Do not rely on the auto-generated dev value — it invalidates sessions on restart.","Add a pre-deploy env validation step that checks SSO-required variables.","Watch for dev-only console warnings locally; they indicate the same missing config will throw in prod."],"tags":["configuration","production","security","session","sso","env-var"],"backgroundTag":"missing-env-var","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}