mastra-ai/mastra · error

Cookie password must be at least 32 characters for SSO. Set

Error message

Cookie password must be at least 32 characters for SSO. Set GOOGLE_COOKIE_PASSWORD environment variable.

What it means

When a Google client secret is configured (SSO enabled), the provider encrypts session cookies and requires a cookie password of at least 32 characters. A shorter value cannot be used because weak encryption keys make session cookies brute-forceable, so the constructor rejects it up front.

Source

Thrown at auth/google/src/auth-provider.ts:269

      process.env.GOOGLE_COOKIE_PASSWORD ??
      crypto.randomUUID() + crypto.randomUUID();

    this.clientId = clientId;
    this.clientSecret = clientSecret ?? null;
    this.redirectUri = redirectUri ?? null;
    this.scopes = options?.scopes ?? DEFAULT_SCOPES;
    this.cookieName = options?.session?.cookieName ?? DEFAULT_COOKIE_NAME;
    this.cookieMaxAge = options?.session?.cookieMaxAge ?? DEFAULT_COOKIE_MAX_AGE;
    this.cookiePassword = cookiePassword;
    this.secureCookies = options?.session?.secureCookies ?? process.env.NODE_ENV === 'production';
    this.allowedDomains = allowedDomains;
    this.hostedDomain = configuredHostedDomain ?? (allowedDomains.length === 1 ? allowedDomains[0] : undefined);
    this.ssoEnabled = !!clientSecret;
    this.jwks = createRemoteJWKSet(new URL(GOOGLE_JWKS_URL));

    if (this.ssoEnabled) {
      if (cookiePassword.length < 32) {
        throw new Error(
          'Cookie password must be at least 32 characters for SSO. Set GOOGLE_COOKIE_PASSWORD environment variable.',
        );
      }

      if (!hasConfiguredCookiePassword) {
        const message =
          '[MastraAuthGoogle] GOOGLE_COOKIE_PASSWORD is required for Google SSO in production. Set GOOGLE_COOKIE_PASSWORD or pass session.cookiePassword.';
        if (process.env.NODE_ENV === 'production') {
          throw new Error(message);
        }
        console.warn(
          `${message} Using an auto-generated value for development only; sessions will not survive restarts.`,
        );
      }

      this.attachSSOProvider();
      this.attachSessionProvider();
    }

View on GitHub (pinned to 75dd419e61)

Solutions

1. Set GOOGLE_COOKIE_PASSWORD to a string of at least 32 characters (e.g. openssl rand -base64 32).
2. Or pass a >=32-char value via options: new MastraAuthGoogle({ cookiePassword / session: { cookiePassword } }).
3. Remove the clientSecret if SSO is not intended, so the cookie password check is skipped.
4. Never commit the real value; rotate the stored password if a weak one was previously deployed.

Example fix

// before
GOOGLE_COOKIE_PASSWORD=changeme

// after
GOOGLE_COOKIE_PASSWORD=Kj8mQ2vX7pLw3nRtY6bC1dF5gH9jS4aZ0eU2iO8pP3xN7q

const pw = process.env.GOOGLE_COOKIE_PASSWORD ?? '';
if (process.env.GOOGLE_CLIENT_SECRET && pw.length < 32) {
  throw new Error('GOOGLE_COOKIE_PASSWORD must be at least 32 characters');
}

try {
  const auth = new MastraAuthGoogle({ clientSecret });
} catch (err) {
  if (err instanceof Error && err.message.includes('Cookie password must be at least 32 characters')) {
    console.error('Generate one with: openssl rand -base64 32');
    process.exit(1);
  }
  throw err;
}

When it happens

Trigger: Constructing MastraAuthGoogle with a clientSecret (or GOOGLE_CLIENT_SECRET set) while the resolved cookie password — from session.cookiePassword, options, or GOOGLE_COOKIE_PASSWORD — is a string shorter than 32 characters.

Common situations: Developers using a short placeholder like 'secret' or 'changeme' as GOOGLE_COOKIE_PASSWORD; copying the check from a non-SSO setup where no password is needed; local dev setups promoted to SSO-enabled environments without strengthening the secret.

Related errors

• Cookie password must be at least 32 characters for SSO. Set
• [MastraAuthGoogle] GOOGLE_COOKIE_PASSWORD is required for Go
• ${name} must contain base64-encoded 32-byte keys.
• Invalid encrypted session data
• Cookie password must be at least 32 characters for SSO. Set

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/0c335fe7cf43bf2a. Report an issue: GitHub.