{"record":{"id":"7cb21bb143c9b3db","repo":"mastra-ai/mastra","slug":"cookie-password-must-be-at-least-32-characters-se-7cb21b","errorCode":null,"errorMessage":"Cookie password must be at least 32 characters. Set WORKOS_COOKIE_PASSWORD environment variable or provide session.cookiePassword option.","messagePattern":"Cookie password must be at least 32 characters\\. Set WORKOS_COOKIE_PASSWORD environment variable or provide session\\.cookiePassword option\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"auth/workos/src/auth-provider.ts","lineNumber":139,"sourceCode":"\n    const apiKey = options?.apiKey ?? process.env.WORKOS_API_KEY;\n    const clientId = options?.clientId ?? process.env.WORKOS_CLIENT_ID;\n    // The redirect URI may be resolved later: `init()` derives it from the\n    // host's `publicUrl` when neither the option nor the env var is set.\n    // `getLoginUrl()` fails with a clear error if it never resolves.\n    const redirectUri = options?.redirectUri ?? process.env.WORKOS_REDIRECT_URI ?? '';\n    const cookiePassword =\n      options?.session?.cookiePassword ?? process.env.WORKOS_COOKIE_PASSWORD ?? DEV_COOKIE_PASSWORD;\n\n    if (!apiKey || !clientId) {\n      throw new Error(\n        'WorkOS API key and client ID are required. ' +\n          'Provide them in the options or set WORKOS_API_KEY and WORKOS_CLIENT_ID environment variables.',\n      );\n    }\n\n    if (cookiePassword.length < 32) {\n      throw new Error(\n        'Cookie password must be at least 32 characters. ' +\n          'Set WORKOS_COOKIE_PASSWORD environment variable or provide session.cookiePassword option.',\n      );\n    }\n\n    this.clientId = clientId;\n    this.redirectUri = redirectUri;\n    this.ssoConfig = options?.sso;\n    this.fetchMemberships = options?.fetchMemberships ?? false;\n    this.trustJwtClaims = options?.trustJwtClaims ?? false;\n    this.jwtClaimOptions = options?.jwtClaims;\n    this.mapJwtPayloadToUser = options?.mapJwtPayloadToUser;\n    this.membershipCache = new LRUCache<string, OrganizationMembership[]>({\n      max: MEMBERSHIP_CACHE_MAX_SIZE,\n      ttl: MEMBERSHIP_CACHE_TTL_MS,\n    });\n\n    // Create WorkOS client","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/auth/workos/src/auth-provider.ts#L121-L157","documentation":"The WorkOS auth provider uses a cookie password to encrypt session cookies, and WorkOS requires it to be at least 32 characters. If options.session.cookiePassword, WORKOS_COOKIE_PASSWORD, or the built-in dev fallback resolve to a value shorter than 32 chars, construction throws to prevent insecure or invalid session encryption.","triggerScenarios":"`new MastraAuthWorkos(options)` where the resolved cookiePassword (option > env > DEV_COOKIE_PASSWORD) has length < 32.","commonSituations":"Short placeholder passwords set in env ('mysecret'); DEV_COOKIE_PASSWORD fallback leaking into a developer's setup and being rejected by policy; password truncated by quotes/whitespace issues in env files; someone rotating the secret to a shorter value.","solutions":["Set WORKOS_COOKIE_PASSWORD to a strong value of at least 32 characters (e.g. generate with `openssl rand -base64 32`)","Pass session.cookiePassword explicitly with a >=32 char value","Check the raw env var length — surrounding quotes are not stripped in all dotenv setups","Use the same value across all instances; changing it invalidates existing sessions"],"exampleFix":"// before\nWORKOS_COOKIE_PASSWORD=shortsecret\n// after\nWORKOS_COOKIE_PASSWORD=openssl-rand-base64-32-output-here>=32chars","handlingStrategy":"validation","validationCode":"function assertCookiePassword(opts) {\n  const pw = opts?.session?.cookiePassword ?? process.env.WORKOS_COOKIE_PASSWORD;\n  if (!pw || pw.length < 32) {\n    throw new Error('WORKOS_COOKIE_PASSWORD must be at least 32 chars (got ' + (pw?.length ?? 0) + ')');\n  }\n  return pw;\n}","typeGuard":"function hasValidCookiePassword(o) {\n  const pw = o?.session?.cookiePassword;\n  return typeof pw === 'string' && pw.length >= 32;\n}","tryCatchPattern":"try {\n  auth = new MastraAuthWorkos(options);\n} catch (e) {\n  if (e.message.includes('Cookie password must be at least 32 characters')) {\n    throw new ConfigError('Generate one: openssl rand -base64 32');\n  }\n  throw e;\n}","preventionTips":["Generate cookie passwords with a random generator, never by hand","Add a length check to your config test suite","Be aware the dev fallback only applies when neither option nor env is set — always set one in real environments","Keep the value stable; rotating it invalidates all active sessions"],"tags":["config","workos","security","cookies","validation"],"backgroundTag":"invalid-credential-configuration","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}