{"record":{"id":"8fd53140fd7a0494","repo":"mastra-ai/mastra","slug":"cookie-password-must-be-at-least-32-characters-for","errorCode":null,"errorMessage":"Cookie password must be at least 32 characters for SSO. Set AUTH0_COOKIE_PASSWORD environment variable.","messagePattern":"Cookie password must be at least 32 characters for SSO\\. Set AUTH0_COOKIE_PASSWORD environment variable\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"auth/auth0/src/index.ts","lineNumber":331,"sourceCode":"      options?.session?.cookiePassword ??\n      process.env.AUTH0_COOKIE_PASSWORD ??\n      crypto.randomUUID() + crypto.randomUUID();\n\n    this.clientId = clientId ?? null;\n    this.clientSecret = clientSecret ?? null;\n    this._redirectUri = redirectUri ?? null;\n    this.scopes = options?.scopes ?? DEFAULT_SCOPES;\n    this.cookieName = options?.session?.cookieName ?? DEFAULT_COOKIE_NAME;\n    this.cookieMaxAge = options?.session?.cookieMaxAge ?? DEFAULT_COOKIE_MAX_AGE;\n    this.cookiePassword = cookiePassword;\n    this.secureCookies = options?.session?.secureCookies ?? process.env.NODE_ENV === 'production';\n\n    // SSO is enabled when OAuth credentials are configured\n    this.ssoEnabled = !!(clientId && clientSecret);\n\n    if (this.ssoEnabled) {\n      if (cookiePassword.length < 32) {\n        throw new Error(\n          'Cookie password must be at least 32 characters for SSO. Set AUTH0_COOKIE_PASSWORD environment variable.',\n        );\n      }\n\n      if (!options?.session?.cookiePassword && !process.env.AUTH0_COOKIE_PASSWORD) {\n        console.warn(\n          '[MastraAuthAuth0] No cookie password set — using auto-generated value. Sessions will not survive restarts. Set AUTH0_COOKIE_PASSWORD for production use.',\n        );\n      }\n\n      // Dynamically add ISSOProvider + ISessionProvider methods\n      this._attachSSOProvider();\n      this._attachSessionProvider();\n    }\n\n    this.registerOptions(options);\n  }\n","sourceCodeStart":313,"sourceCodeEnd":349,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/auth/auth0/src/index.ts#L313-L349","documentation":"When OAuth client credentials are present, SSO is enabled and the provider uses the cookie password to encrypt/sign the session cookie, which requires at least 32 characters for adequate security. If the resolved cookiePassword (from options.session.cookiePassword or AUTH0_COOKIE_PASSWORD) is shorter than 32 chars, the constructor throws rather than running SSO with a weak cookie secret.","triggerScenarios":"Constructing the auth0 provider with clientId and clientSecret set (enabling SSO) while the effective cookiePassword is under 32 characters — e.g. AUTH0_COOKIE_PASSWORD unset combined with a default/short value, or a short value passed in options.session.cookiePassword.","commonSituations":"Setting AUTH0_COOKIE_PASSWORD to a short or placeholder value ('secret', 'changeme'); forgetting the env var entirely and falling back to a short default; copy-pasting a dev secret into production that was already too short.","solutions":["Generate a strong secret of at least 32 characters (e.g. `openssl rand -base64 32`) and set it as AUTH0_COOKIE_PASSWORD","Pass it explicitly via options: new AuthOServerAuth({ ..., session: { cookiePassword: longSecret } })","Ensure the same cookie password is consistent across all instances so existing sessions remain decryptable after the change"],"exampleFix":"// before\nAUTH0_COOKIE_PASSWORD=mysecret\n// after\n# generated with: openssl rand -base64 32\nAUTH0_COOKIE_PASSWORD=q8Xv2Lp9Rw3Kd7Tn1Ys6Zf4Hb0Cm5Jg2Au8Ee1Ir4Ox=","handlingStrategy":"validation","validationCode":"const cookiePassword =\n  options?.session?.cookiePassword ?? process.env.AUTH0_COOKIE_PASSWORD ?? '';\nif ((options?.clientId && options?.clientSecret) && cookiePassword.length < 32) {\n  throw new Error('AUTH0_COOKIE_PASSWORD must be at least 32 characters when SSO is enabled');\n}","typeGuard":"function hasStrongCookiePassword(pw: string | undefined): pw is string {\n  return typeof pw === 'string' && pw.length >= 32;\n}","tryCatchPattern":"try {\n  provider = new AuthOServerAuth({ clientId, clientSecret, ... });\n} catch (e) {\n  if (e instanceof Error && e.message.includes('Cookie password must be at least 32 characters')) {\n    throw new Error('SSO enabled but AUTH0_COOKIE_PASSWORD is missing/too short; generate one with `openssl rand -base64 32`', { cause: e });\n  }\n  throw e;\n}","preventionTips":["Generate the cookie password with `openssl rand -base64 32` and store it in your secret manager","Only set clientId/clientSecret together with a strong cookie password","Keep the cookie password identical across all app instances","Rotate carefully: changing it invalidates existing sessions"],"tags":["auth0","sso","cookie-security","configuration"],"backgroundTag":"missing-env-var","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}