redis/node-redis · error · Error

SESSION_SECRET environment variable must be set

Error message

SESSION_SECRET environment variable must be set

What it means

Startup guard in the auth-code-pkce sample (samples/auth-code-pkce/index.ts:8): the express-session middleware requires a `secret` to sign session cookies, and the sample reads it exclusively from process.env.SESSION_SECRET. Without it the PKCE verifier/challenge stored in the session could not be protected, so the sample refuses to boot.

Source

Thrown at packages/entraid/samples/auth-code-pkce/index.ts:9

import express, { Request, Response } from 'express';
import session from 'express-session';
import dotenv from 'dotenv';
import { DEFAULT_TOKEN_MANAGER_CONFIG, EntraIdCredentialsProviderFactory } from '../../lib/entra-id-credentials-provider-factory';

dotenv.config();

if (!process.env.SESSION_SECRET) {
  throw new Error('SESSION_SECRET environment variable must be set');
}

interface PKCESession extends session.Session {
  pkceCodes?: {
    verifier: string;
    challenge: string;
    challengeMethod: string;
  };
}

interface AuthRequest extends Request {
  session: PKCESession;
}

const app = express();

const sessionConfig = {
  secret: process.env.SESSION_SECRET,

View on GitHub (pinned to bb5beb5657)

Solutions

1. Create a .env file in packages/entraid with `SESSION_SECRET=<long-random-string>` (dotenv.config() loads it).
2. Or export it in the shell: `export SESSION_SECRET=$(openssl rand -hex 32)`.
3. Ensure you launch the sample from a working directory where dotenv can resolve the .env path.
4. Generate a cryptographically random value of at least 32 bytes.

Example fix

# before: env unset -> sample throws on import
# after (.env in packages/entraid)
SESSION_SECRET=9f1c2a4b8e7d6a5f3c2b1a0998e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1908

// Fail fast with a clearer message before the sample throws.
if (!process.env.SESSION_SECRET) {
  throw new Error('SESSION_SECRET missing — create packages/entraid/.env with SESSION_SECRET=<random>');
}

const hasSessionSecret = (): boolean =>
  typeof process.env.SESSION_SECRET === 'string' && process.env.SESSION_SECRET.length >= 32;

When it happens

Trigger: Running `tsx samples/auth-code-pkce/index.ts` (or the built sample) without SESSION_SECRET defined in the environment or in a loaded .env file.

Common situations: Forgetting to copy .env.example to .env; running the sample in a shell/container where SESSION_SECRET was not exported; dotenv not finding the .env file because of cwd.

Related errors

• SESSION_SECRET environment variable must be set
• MSAL_CLIENT_ID and MSAL_TENANT_ID environment variables must
• MSAL_CLIENT_ID and MSAL_TENANT_ID environment variables must
• Invalid authority configuration
• Reconnect strategy should return `false | Error | number`, g

AI-assisted analysis of redis/node-redis@bb5beb5657 (2026-08-03). Data as JSON: /data/errors/a6aab0acf4c2cad1.json. Report an issue: GitHub.