express-session deprecated req.secret; provide secret option app.js:27:9

Question

I typed npm start to run my program but this is the comment that U received in the terminal: express-session deprecated req.secret; provide secret option app.js:27:9. I don't understand how this issue needs to be fixed. This is the code from app.js:27:9

app.use(session({
    store: new FileStore(),
    secret: process.env.SESSION_SECRET,
    resave: false,
    saveUninitialized: true,
    is_logged_in: false,
}))

Allhallowmas

check the existence of SESSION_SECRET – Elliott

tldr; express-session was not given your secret. the value in process.env.SESSION_SECRET (or whatever you passed to the secret option) is empty. – Abysmal

Answer 1

Make sure you added the SESSION_SECRET in .env file. If yes, then in your app.js, add this

const dotenv = require('dotenv').config()

Drone

Make sure dotenv is installed: npm i dotenv – Bon

Answer 2

You need to load all your environment variables. at line one on the server.js file write this...

if (process.env.NODE_ENV !== 'production') { require('dotenv').config() }

Sihun

Answer 3

I had this same issue and the culprit was adding the SESSION_SECRET to my .env file.

Galibi

Answer 4

If you are on running on Linux server: Add environment variables here

edit /etc/environment

Add:

export SESSION_SECRET="Ssdsd@#e$#Rfe@#$d#$#"

You can check if this is correct created with:

printenv or printenv SESSION_SECRET

..and yes, and in your express:

const dotenv = require('dotenv').config() 

app.use(session({
    secret: process.env.SESSION_SECRET
});

Hostetler

I have added .env file and dotenv package config too. but i still get deprecated warning message ' express-session deprecated req.secret; provide secret option'. I found that env variable value was some how empty i have modified the line secret: process.env.SESSION_SECRET || 'myvaluehere' and now warning gone away. thanks – Thrift

but what's the use of writing secret : process.env.SESSION_SECRET || 'myvaluehere'. we use dotenv to hide the secrets and by doing the thing that you mentioned the vaule is easily accessible to the person who opens the app.js. Instead you could have written it directly and not used dotenv – Rawdon

Answer 5

If you added the SESSION_SECRET in your .env file already(SESSION_SECRET='this is my session'),then do require dotenv in your app.js file similar to the following:

const dotenv = require('dotenv').config({path:'./.env'});

mentioning path is important otherwise it's not detecting SESSION_SECRET from .env file.

Helbonia

Answer 6

I was facing the same problem go checkout wether your .env and .gitignore files are in the same folder where server.js is .

Hickey

As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center. – Contingency

Answer 7

My solution:

Create file: config.js

const cfg = {
    ...,
    secured_key: '06vUSNEzq1z9U476UrMEx7xIOPGYfu2m',
    ...
}

module.exports = cfg;

In app.js

...
const cfg = require('./config');
...

app.use(session({
    secret: cfg.secured_key,
    resave: false,
    saveUninitialized: false
}));
...

This error resolve.

Phyla

Answer 8

I have had the similar issue and have used this code below to resolve it:

dotenv.config({ path: path.resolve(__dirname, "../config.env") });

Lyndonlyndsay

Answer 9

Put the dotenv config up the lines where you are exporting the files, for example:

const express = require("express"); require("dotenv").config(); const dbConnect = require("./config/mongo"); const userSession = require("./config/session");

Fermin