{"record":{"id":"8751f4d031a4379b","repo":"mastra-ai/mastra","slug":"cookie-password-must-be-at-least-32-characters-for-8751f4","errorCode":null,"errorMessage":"Cookie password must be at least 32 characters for SSO. Set CLERK_COOKIE_PASSWORD environment variable.","messagePattern":"Cookie password must be at least 32 characters for SSO\\. Set CLERK_COOKIE_PASSWORD environment variable\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"auth/clerk/src/index.ts","lineNumber":323,"sourceCode":"      options?.session?.cookiePassword ??\n      process.env.CLERK_COOKIE_PASSWORD ??\n      crypto.randomUUID() + crypto.randomUUID();\n\n    this.oauthClientId = oauthClientId ?? null;\n    this.oauthClientSecret = oauthClientSecret ?? null;\n    this._redirectUri = redirectUri ?? null;\n    this.scopes = options?.scopes ?? DEFAULT_SCOPES;\n    this.cookieName = options?.session?.cookieName ?? DEFAULT_COOKIE_NAME;\n    this.cookieMaxAge = options?.session?.cookieMaxAge ?? DEFAULT_COOKIE_MAX_AGE;\n    this.cookiePassword = cookiePassword;\n    this.secureCookies = options?.session?.secureCookies ?? process.env.NODE_ENV === 'production';\n\n    // SSO is enabled when OAuth credentials are configured\n    this.ssoEnabled = !!(oauthClientId && oauthClientSecret);\n\n    if (this.ssoEnabled) {\n      if (cookiePassword.length < 32) {\n        throw new Error(\n          'Cookie password must be at least 32 characters for SSO. Set CLERK_COOKIE_PASSWORD environment variable.',\n        );\n      }\n\n      if (!options?.session?.cookiePassword && !process.env.CLERK_COOKIE_PASSWORD) {\n        console.warn(\n          '[MastraAuthClerk] No cookie password set — using auto-generated value. Sessions will not survive restarts. Set CLERK_COOKIE_PASSWORD for production use.',\n        );\n      }\n\n      // Dynamically add ISSOProvider + ISessionProvider methods\n      // so that duck-typing detection (implementsInterface) only finds them when SSO is configured\n      this._attachSSOProvider();\n      this._attachSessionProvider();\n    }\n\n    this.registerOptions(options);\n  }","sourceCodeStart":305,"sourceCodeEnd":341,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/auth/clerk/src/index.ts#L305-L341","documentation":"When OAuth credentials (client id + secret) are present, SSO mode is enabled and the provider encrypts session/state data with a cookie password using AES. Node's crypto enforces a minimum key length for the AES-256 key derivation used here, so if the resolved cookiePassword is shorter than 32 characters the constructor throws instead of silently deriving a weak key. The password comes from options.session.cookiePassword or CLERK_COOKIE_PASSWORD.","triggerScenarios":"Constructing ClerkAuthProvider with oauthClientId and oauthClientSecret set while the effective cookiePassword (options.session.cookiePassword ?? CLERK_COOKIE_PASSWORD) has length < 32.","commonSituations":"A short placeholder like 'password123' or a dev value promoted to production; the env var set to a 16/24-char string; assuming any non-empty password works once SSO is enabled; truncation of the value by a deployment platform.","solutions":["Set CLERK_COOKIE_PASSWORD to a string of at least 32 characters (e.g. a 32+ char random secret).","Or pass options: new ClerkAuthProvider({ ..., session: { cookiePassword: '<32+ chars>' } }).","Generate one with `openssl rand -base64 32` (or `node -e \"console.log(require('crypto').randomBytes(32).toString('base64'))\"`).","If you don't need SSO, remove oauthClientId/oauthClientSecret so the password requirement doesn't apply."],"exampleFix":"// before\nCLERK_COOKIE_PASSWORD=short-secret\n// after\nCLERK_COOKIE_PASSWORD=openssl-rand-base64-32-output-which-is-at-least-32-chars-long","handlingStrategy":"validation","validationCode":"const cookiePassword = process.env.CLERK_COOKIE_PASSWORD;\nif (ssoEnabled && (!cookiePassword || cookiePassword.length < 32)) {\n  throw new Error('CLERK_COOKIE_PASSWORD must be set and >= 32 characters');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate the password with `openssl rand -base64 32` and store it in your secret manager.","Add a startup assertion that SSO-enabled configs carry a 32+ char password.","Watch for the accompanying console.warn when relying on the env var instead of options."],"tags":["auth","clerk","sso","configuration","encryption"],"backgroundTag":"invalid-credential-length","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}