redis/node-redis · error · Error

SESSION_SECRET environment variable must be set

Error message

SESSION_SECRET environment variable must be set

What it means

Startup guard in the interactive-browser sample (samples/interactive-browser/index.ts:9), identical in purpose to error 94: express-session needs process.env.SESSION_SECRET to sign cookies, and the sample refuses to start without it.

Source

Thrown at packages/entraid/samples/interactive-browser/index.ts:10

import express, { Request, Response } from 'express';
import session from 'express-session';
import dotenv from 'dotenv';
import { DEFAULT_TOKEN_MANAGER_CONFIG, EntraIdCredentialsProviderFactory } from '../../lib/entra-id-credentials-provider-factory';
import { InteractiveBrowserCredential } from '@azure/identity';

dotenv.config();

if (!process.env.SESSION_SECRET) {
  throw new Error('SESSION_SECRET environment variable must be set');
}

const app = express();

const sessionConfig = {
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: process.env.NODE_ENV === 'production', // Only use secure in production
    httpOnly: true,
    sameSite: 'lax',
    maxAge: 3600000 // 1 hour
  }
} as const;

app.use(session(sessionConfig));

View on GitHub (pinned to bb5beb5657)

Solutions

1. Add `SESSION_SECRET=<long-random-string>` to packages/entraid/.env.
2. Or export it in the shell before launching the sample.
3. Use at least 32 bytes of randomness.
4. Confirm the launch cwd so dotenv.config() loads the file.

Example fix

# .env
SESSION_SECRET=3a7f2b9e1c4d8a5f6b0e2c9d7a4f1b8e3c6d5a9f2b7e4c1d8a3f6b0e5c2d9a7f

if (!process.env.SESSION_SECRET) {
  throw new Error('SESSION_SECRET missing — create packages/entraid/.env with SESSION_SECRET=<random>');
}

const hasSessionSecret = (): boolean =>
  typeof process.env.SESSION_SECRET === 'string' && process.env.SESSION_SECRET.length >= 32;

When it happens

Trigger: Running the interactive-browser sample without SESSION_SECRET in the environment or in a loaded .env file.

Common situations: Missing .env; blanked-out value copied from .env.example; launching from a directory where dotenv does not find .env.

Related errors

• SESSION_SECRET environment variable must be set
• MSAL_CLIENT_ID and MSAL_TENANT_ID environment variables must
• MSAL_CLIENT_ID and MSAL_TENANT_ID environment variables must
• Invalid authority configuration
• Reconnect strategy should return `false | Error | number`, g

AI-assisted analysis of redis/node-redis@bb5beb5657 (2026-08-03). Data as JSON: /data/errors/2db32a57c0accd16.json. Report an issue: GitHub.