{"id":"a6aab0acf4c2cad1","repo":"redis/node-redis","slug":"session-secret-environment-variable-must-be-set","errorCode":null,"errorMessage":"SESSION_SECRET environment variable must be set","messagePattern":"SESSION_SECRET environment variable must be set","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/entraid/samples/auth-code-pkce/index.ts","lineNumber":9,"sourceCode":"import express, { Request, Response } from 'express';\nimport session from 'express-session';\nimport dotenv from 'dotenv';\nimport { DEFAULT_TOKEN_MANAGER_CONFIG, EntraIdCredentialsProviderFactory } from '../../lib/entra-id-credentials-provider-factory';\n\ndotenv.config();\n\nif (!process.env.SESSION_SECRET) {\n  throw new Error('SESSION_SECRET environment variable must be set');\n}\n\ninterface PKCESession extends session.Session {\n  pkceCodes?: {\n    verifier: string;\n    challenge: string;\n    challengeMethod: string;\n  };\n}\n\ninterface AuthRequest extends Request {\n  session: PKCESession;\n}\n\nconst app = express();\n\nconst sessionConfig = {\n  secret: process.env.SESSION_SECRET,","sourceCodeStart":1,"sourceCodeEnd":27,"githubUrl":"https://github.com/redis/node-redis/blob/bb5beb56578573910e2ee8f39681edc214c41398/packages/entraid/samples/auth-code-pkce/index.ts#L1-L27","documentation":"Startup guard in the auth-code-pkce sample (samples/auth-code-pkce/index.ts:8): the express-session middleware requires a `secret` to sign session cookies, and the sample reads it exclusively from process.env.SESSION_SECRET. Without it the PKCE verifier/challenge stored in the session could not be protected, so the sample refuses to boot.","triggerScenarios":"Running `tsx samples/auth-code-pkce/index.ts` (or the built sample) without SESSION_SECRET defined in the environment or in a loaded .env file.","commonSituations":"Forgetting to copy .env.example to .env; running the sample in a shell/container where SESSION_SECRET was not exported; dotenv not finding the .env file because of cwd.","solutions":["Create a .env file in packages/entraid with `SESSION_SECRET=<long-random-string>` (dotenv.config() loads it).","Or export it in the shell: `export SESSION_SECRET=$(openssl rand -hex 32)`.","Ensure you launch the sample from a working directory where dotenv can resolve the .env path.","Generate a cryptographically random value of at least 32 bytes."],"exampleFix":"# before: env unset -> sample throws on import\n# after (.env in packages/entraid)\nSESSION_SECRET=9f1c2a4b8e7d6a5f3c2b1a0998e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1908","handlingStrategy":"validation","validationCode":"// Fail fast with a clearer message before the sample throws.\nif (!process.env.SESSION_SECRET) {\n  throw new Error('SESSION_SECRET missing — create packages/entraid/.env with SESSION_SECRET=<random>');\n}","typeGuard":"const hasSessionSecret = (): boolean =>\n  typeof process.env.SESSION_SECRET === 'string' && process.env.SESSION_SECRET.length >= 32;","tryCatchPattern":null,"preventionTips":["Commit a .env.example with SESSION_SECRET documented; keep .env out of git.","Generate with `openssl rand -hex 32`.","Confirm the launch cwd so dotenv.config() finds .env.","Validate env at startup with a single loader."],"tags":["configuration","environment","sample","entraid","security"],"analyzedSha":"bb5beb56578573910e2ee8f39681edc214c41398","analyzedAt":"2026-08-03T19:09:15.686Z","schemaVersion":2}