{"id":"2db32a57c0accd16","repo":"redis/node-redis","slug":"session-secret-environment-variable-must-be-set-2db32a","errorCode":null,"errorMessage":"SESSION_SECRET environment variable must be set","messagePattern":"SESSION_SECRET environment variable must be set","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/entraid/samples/interactive-browser/index.ts","lineNumber":10,"sourceCode":"import express, { Request, Response } from 'express';\nimport session from 'express-session';\nimport dotenv from 'dotenv';\nimport { DEFAULT_TOKEN_MANAGER_CONFIG, EntraIdCredentialsProviderFactory } from '../../lib/entra-id-credentials-provider-factory';\nimport { InteractiveBrowserCredential } from '@azure/identity';\n\ndotenv.config();\n\nif (!process.env.SESSION_SECRET) {\n  throw new Error('SESSION_SECRET environment variable must be set');\n}\n\nconst app = express();\n\nconst sessionConfig = {\n  secret: process.env.SESSION_SECRET,\n  resave: false,\n  saveUninitialized: false,\n  cookie: {\n    secure: process.env.NODE_ENV === 'production', // Only use secure in production\n    httpOnly: true,\n    sameSite: 'lax',\n    maxAge: 3600000 // 1 hour\n  }\n} as const;\n\napp.use(session(sessionConfig));\n","sourceCodeStart":1,"sourceCodeEnd":28,"githubUrl":"https://github.com/redis/node-redis/blob/bb5beb56578573910e2ee8f39681edc214c41398/packages/entraid/samples/interactive-browser/index.ts#L1-L28","documentation":"Startup guard in the interactive-browser sample (samples/interactive-browser/index.ts:9), identical in purpose to error 94: express-session needs process.env.SESSION_SECRET to sign cookies, and the sample refuses to start without it.","triggerScenarios":"Running the interactive-browser sample without SESSION_SECRET in the environment or in a loaded .env file.","commonSituations":"Missing .env; blanked-out value copied from .env.example; launching from a directory where dotenv does not find .env.","solutions":["Add `SESSION_SECRET=<long-random-string>` to packages/entraid/.env.","Or export it in the shell before launching the sample.","Use at least 32 bytes of randomness.","Confirm the launch cwd so dotenv.config() loads the file."],"exampleFix":"# .env\nSESSION_SECRET=3a7f2b9e1c4d8a5f6b0e2c9d7a4f1b8e3c6d5a9f2b7e4c1d8a3f6b0e5c2d9a7f","handlingStrategy":"validation","validationCode":"if (!process.env.SESSION_SECRET) {\n  throw new Error('SESSION_SECRET missing — create packages/entraid/.env with SESSION_SECRET=<random>');\n}","typeGuard":"const hasSessionSecret = (): boolean =>\n  typeof process.env.SESSION_SECRET === 'string' && process.env.SESSION_SECRET.length >= 32;","tryCatchPattern":null,"preventionTips":["Put SESSION_SECRET in packages/entraid/.env (gitignored).","Generate with `openssl rand -hex 32`.","Validate env at startup with a single loader.","Confirm the launch cwd so dotenv resolves .env."],"tags":["configuration","environment","sample","entraid","security"],"analyzedSha":"bb5beb56578573910e2ee8f39681edc214c41398","analyzedAt":"2026-08-03T19:09:15.686Z","schemaVersion":2}