{"record":{"id":"7481532eb692e502","repo":"mastra-ai/mastra","slug":"cookie-password-must-be-at-least-32-characters-se","errorCode":null,"errorMessage":"Cookie password must be at least 32 characters. Set OKTA_COOKIE_PASSWORD environment variable.","messagePattern":"Cookie password must be at least 32 characters\\. Set OKTA_COOKIE_PASSWORD environment variable\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"auth/okta/src/auth-provider.ts","lineNumber":175,"sourceCode":"      throw new Error(\n        'Okta client ID is required. Provide it in the options or set OKTA_CLIENT_ID environment variable.',\n      );\n    }\n\n    if (!clientSecret) {\n      throw new Error(\n        'Okta client secret is required for SSO. Provide it in the options or set OKTA_CLIENT_SECRET environment variable.',\n      );\n    }\n\n    if (!redirectUri) {\n      throw new Error(\n        'Okta redirect URI is required for SSO. Provide it in the options or set OKTA_REDIRECT_URI environment variable.',\n      );\n    }\n\n    if (cookiePassword.length < 32) {\n      throw new Error('Cookie password must be at least 32 characters. Set OKTA_COOKIE_PASSWORD environment variable.');\n    }\n\n    this.domain = domain;\n    this.clientId = clientId;\n    this.clientSecret = clientSecret;\n    // Normalize trailing slashes so a stray `OKTA_ISSUER=https://domain/` doesn't produce `.../oauth2//v1/...`\n    this.issuer = trimTrailingSlashes(issuer ?? `https://${domain}/oauth2/default`);\n    // Org authorization servers use issuer `https://{domain}` but serve endpoints under `/oauth2/v1/*`.\n    // Custom authorization servers use issuer `https://{domain}/oauth2/<name>` and serve endpoints under `<issuer>/v1/*`.\n    // `issuer` is still used verbatim for JWT `iss`-claim validation on both server types.\n    this.endpointBase =\n      this.issuer.includes('/oauth2/') || this.issuer.endsWith('/oauth2') ? this.issuer : `${this.issuer}/oauth2`;\n    this.redirectUri = redirectUri;\n    // Defaults to the client ID, which is the `aud` of an Okta ID token. Deployments that\n    // send access tokens need the authorization server's audience instead.\n    this.audience = options?.audience ?? process.env.OKTA_AUDIENCE ?? clientId;\n    this.scopes = options?.scopes ?? DEFAULT_SCOPES;\n    this.cookieName = options?.session?.cookieName ?? DEFAULT_COOKIE_NAME;","sourceCodeStart":157,"sourceCodeEnd":193,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/auth/okta/src/auth-provider.ts#L157-L193","documentation":"Validation thrown in the OktaAuthProvider constructor when the session cookie password is shorter than 32 characters. The cookie password is the encryption/signing key for the SSO session cookie, which requires at least 32 characters. Note the default (crypto.randomUUID() + crypto.randomUUID()) always satisfies this, so the error only fires when an explicit short password is supplied.","triggerScenarios":"new OktaAuthProvider(...) with options.session.cookiePassword (or OKTA_COOKIE_PASSWORD) set to a string shorter than 32 characters.","commonSituations":"Developer sets a short placeholder like 'secret' in local env; env var contains a truncated or mis-copied value; a placeholder from documentation was never replaced.","solutions":["Set OKTA_COOKIE_PASSWORD to a string of at least 32 characters (e.g. generate with `openssl rand -base64 32`).","Remove the explicit cookiePassword so the provider generates a secure random default (note: not stable across restarts).","Verify the env var wasn't truncated by quoting rules or line-length limits in your .env/deployment config.","Keep the value stable per environment to avoid invalidating existing session cookies."],"exampleFix":"// before\nOKTA_COOKIE_PASSWORD=shortsecret\n// after\nOKTA_COOKIE_PASSWORD=\"openssl-rand-base64-32-generated-long-value-here==\"","handlingStrategy":"validation","validationCode":"const cp = process.env.OKTA_COOKIE_PASSWORD;\nif (cp !== undefined && cp.length < 32) {\n  throw new Error('OKTA_COOKIE_PASSWORD must be at least 32 characters');\n}","typeGuard":null,"tryCatchPattern":"try {\n  auth = new OktaAuthProvider();\n} catch (e) {\n  if (e instanceof Error && e.message.includes('Cookie password must be at least 32')) {\n    throw new Error('Replace OKTA_COOKIE_PASSWORD with a 32+ char secret (openssl rand -base64 32)');\n  }\n  throw e;\n}","preventionTips":["Generate cookie passwords with openssl rand -base64 32 and store them in the secret manager.","Add a length check in your env-var startup validation.","Keep the value stable per environment to avoid invalidating sessions."],"tags":["okta","configuration","validation","security"],"backgroundTag":"weak-cookie-secret","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}