mastra-ai/mastra · critical

Cookie password must be at least 32 characters for SSO. Set

Error message

Cookie password must be at least 32 characters for SSO. Set AUTH0_COOKIE_PASSWORD environment variable.

What it means

When OAuth client credentials are present, SSO is enabled and the provider uses the cookie password to encrypt/sign the session cookie, which requires at least 32 characters for adequate security. If the resolved cookiePassword (from options.session.cookiePassword or AUTH0_COOKIE_PASSWORD) is shorter than 32 chars, the constructor throws rather than running SSO with a weak cookie secret.

Source

Thrown at auth/auth0/src/index.ts:331

      options?.session?.cookiePassword ??
      process.env.AUTH0_COOKIE_PASSWORD ??
      crypto.randomUUID() + crypto.randomUUID();

    this.clientId = clientId ?? null;
    this.clientSecret = clientSecret ?? null;
    this._redirectUri = redirectUri ?? null;
    this.scopes = options?.scopes ?? DEFAULT_SCOPES;
    this.cookieName = options?.session?.cookieName ?? DEFAULT_COOKIE_NAME;
    this.cookieMaxAge = options?.session?.cookieMaxAge ?? DEFAULT_COOKIE_MAX_AGE;
    this.cookiePassword = cookiePassword;
    this.secureCookies = options?.session?.secureCookies ?? process.env.NODE_ENV === 'production';

    // SSO is enabled when OAuth credentials are configured
    this.ssoEnabled = !!(clientId && clientSecret);

    if (this.ssoEnabled) {
      if (cookiePassword.length < 32) {
        throw new Error(
          'Cookie password must be at least 32 characters for SSO. Set AUTH0_COOKIE_PASSWORD environment variable.',
        );
      }

      if (!options?.session?.cookiePassword && !process.env.AUTH0_COOKIE_PASSWORD) {
        console.warn(
          '[MastraAuthAuth0] No cookie password set — using auto-generated value. Sessions will not survive restarts. Set AUTH0_COOKIE_PASSWORD for production use.',
        );
      }

      // Dynamically add ISSOProvider + ISessionProvider methods
      this._attachSSOProvider();
      this._attachSessionProvider();
    }

    this.registerOptions(options);
  }

View on GitHub (pinned to 75dd419e61)

Solutions

1. Generate a strong secret of at least 32 characters (e.g. `openssl rand -base64 32`) and set it as AUTH0_COOKIE_PASSWORD
2. Pass it explicitly via options: new AuthOServerAuth({ ..., session: { cookiePassword: longSecret } })
3. Ensure the same cookie password is consistent across all instances so existing sessions remain decryptable after the change

Example fix

// before
AUTH0_COOKIE_PASSWORD=mysecret
// after
# generated with: openssl rand -base64 32
AUTH0_COOKIE_PASSWORD=q8Xv2Lp9Rw3Kd7Tn1Ys6Zf4Hb0Cm5Jg2Au8Ee1Ir4Ox=

const cookiePassword =
  options?.session?.cookiePassword ?? process.env.AUTH0_COOKIE_PASSWORD ?? '';
if ((options?.clientId && options?.clientSecret) && cookiePassword.length < 32) {
  throw new Error('AUTH0_COOKIE_PASSWORD must be at least 32 characters when SSO is enabled');
}

function hasStrongCookiePassword(pw: string | undefined): pw is string {
  return typeof pw === 'string' && pw.length >= 32;
}

try {
  provider = new AuthOServerAuth({ clientId, clientSecret, ... });
} catch (e) {
  if (e instanceof Error && e.message.includes('Cookie password must be at least 32 characters')) {
    throw new Error('SSO enabled but AUTH0_COOKIE_PASSWORD is missing/too short; generate one with `openssl rand -base64 32`', { cause: e });
  }
  throw e;
}

When it happens

Trigger: Constructing the auth0 provider with clientId and clientSecret set (enabling SSO) while the effective cookiePassword is under 32 characters — e.g. AUTH0_COOKIE_PASSWORD unset combined with a default/short value, or a short value passed in options.session.cookiePassword.

Common situations: Setting AUTH0_COOKIE_PASSWORD to a short or placeholder value ('secret', 'changeme'); forgetting the env var entirely and falling back to a short default; copy-pasting a dev secret into production that was already too short.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• State token has expired
• Auth0 domain and audience are required, please provide them
• Redirect URI is required for SSO. Set AUTH0_REDIRECT_URI or
• Cookie password must be at least 32 characters for SSO. Set
• Redirect URI is required for SSO login

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/8fd53140fd7a0494. Report an issue: GitHub.