How to fix auth/invalid-session-cookie-duration: Session cookie duration must be 5min-2weeks in Firebase

FirebaseINTERMEDIATEMEDIUMUpdated Dec 12, 2025· 134 views

The Firebase Admin SDK enforces session cookies to last between five minutes and two weeks, so creating a session cookie with a shorter or longer duration fails with this error and prevents the login endpoint from issuing authenticated cookies.

Quick fix

Fixes auth/invalid-session-cookie-duration

const MIN_SESSION_LENGTH = 5 * 60 * 1000; // 5 minutes
const MAX_SESSION_LENGTH = 14 * 24 * 60 * 60 * 1000; // 2 weeks
const requestedDuration = Number(req.body.durationMs ?? MIN_SESSION_LENGTH);
if (!Number.isFinite(requestedDuration)) {
  throw new Error('Missing or invalid session duration');
}
const expiresIn = Math.min(Math.max(requestedDuration, MIN_SESSION_LENGTH), MAX_SESSION_LENGTH);

const sessionCookie = await admin
  .auth()
  .createSessionCookie(idToken, { expiresIn });
  1. Clamp the expiresIn value to Firebase’s supported range
  2. Guard against incorrect units or missing values
  3. Align the cookie maxAge with expiresIn and surface a helpful error
firebase — error
const MIN_SESSION_LENGTH = 5 * 60 * 1000; // 5 minutes
const MAX_SESSION_LENGTH = 14 * 24 * 60 * 60 * 1000; // 2 weeks
const requestedDuration = Number(req.body.durationMs ?? MIN_SESSION_LENGTH);
if (!Number.isFinite(requestedDuration)) {
  throw new Error('Missing or invalid session duration');
}
const expiresIn = Math.min(Math.max(requestedDuration, MIN_SESSION_LENGTH), MAX_SESSION_LENGTH);
const sessionCookie = await admin
  .auth()
  .createSessionCookie(idToken, { expiresIn });
auth/invalid-session-cookie-duration: Session cookie duration must be 5min-2weeks

What this error means

Firebase session cookies are minted by calling createSessionCookie() after a client sends an ID token to a trusted endpoint. The Admin SDK validates the expiresIn value and the documentation only allows durations between 5 minutes and 2 weeks (in milliseconds). Passing a value outside this window—missing the option entirely, using the wrong units, or setting zero/negative values—triggers auth/invalid-session-cookie-duration before the cookie is created.

Typical symptoms

  • Server logs show "auth/invalid-session-cookie-duration: Session cookie duration must be 5min-2weeks" immediately after the client posts to /sessionLogin.
  • createSessionCookie() rejects every request and your endpoint returns 401/500 instead of setting the session cookie.
  • Users cannot stay signed in because the session cookie is never persisted to the browser.
  • Browser console or proxy logs reveal repeated POST retries hitting the same error message.

Common causes

  1. expiresIn is undefined, null or zero because the client never included a duration.
  2. The duration is supplied in seconds (or minutes) and is accidentally inflated beyond two weeks when converted to milliseconds.
  3. A test value under five minutes (e.g., 60 seconds) is passed and the SDK rejects it.
  4. Custom logic clamps maxAge or expiresIn incorrectly, landing outside the supported range.
  5. Expiration value comes from stale configuration where the intended unit changed from milliseconds to seconds.

How to fix "auth/invalid-session-cookie-duration: Session cookie duration must be 5min-2weeks"

1Clamp the expiresIn value to Firebase’s supported range

The Admin SDK expects expiresIn in milliseconds and enforces a minimum of 5 minutes and maximum of 14 days. Normalize the requested duration before calling createSessionCookie():

bash
const MIN_SESSION_LENGTH = 5 * 60 * 1000; // 5 minutes
const MAX_SESSION_LENGTH = 14 * 24 * 60 * 60 * 1000; // 2 weeks
const requestedDuration = Number(req.body.durationMs ?? MIN_SESSION_LENGTH);
if (!Number.isFinite(requestedDuration)) {
  throw new Error('Missing or invalid session duration');
}
const expiresIn = Math.min(Math.max(requestedDuration, MIN_SESSION_LENGTH), MAX_SESSION_LENGTH);

const sessionCookie = await admin
  .auth()
  .createSessionCookie(idToken, { expiresIn });
2Guard against incorrect units or missing values

If you are mapping a TTL from configuration or a user preference, always document the units and parse them safely:

bash
const MIN_SESSION_LENGTH = 5 * 60 * 1000;
const MAX_SESSION_LENGTH = 14 * 24 * 60 * 60 * 1000;
const fallbackDurationMs = 24 * 60 * 60 * 1000; // 1 day
const rawDuration = req.body.durationMs ?? fallbackDurationMs;
const parsed = parseInt(rawDuration.toString(), 10);
const durationMs = Number.isNaN(parsed) ? fallbackDurationMs : parsed;

if (durationMs < MIN_SESSION_LENGTH || durationMs > MAX_SESSION_LENGTH) {
  throw new Error('Session duration must stay within Firebase limits');
}

Picking the wrong unit (seconds instead of milliseconds) or passing undefined will keep the duration outside the allowed window and Firebase will return auth/invalid-session-cookie-duration every time.

3Align the cookie maxAge with expiresIn and surface a helpful error

Once expiresIn is valid, set the cookie maxAge to the same value so the browser cookie expires when the session cookie does:

bash
const sessionCookie = await admin
  .auth()
  .createSessionCookie(idToken, { expiresIn });

res.cookie('session', sessionCookie, {
  maxAge: expiresIn,
  httpOnly: true,
  secure: true,
  sameSite: 'lax',
});

Recording the actual expiresIn in logs (and optionally in telemetry) helps you spot when a configuration drift pushes the duration outside 5 min–2 weeks, leading to reproducible alerting instead of a mysterious 401.

Advanced notes

Firebase spotlights the Manage Session Cookies guide when you implement server-side sessions: set expiresIn in milliseconds, protect your endpoint from CSRF, and keep the cookie lifetime between five minutes and fourteen days as documented in the official session cookie guide.

Frequently asked questions

What does "auth/invalid-session-cookie-duration" mean?
Firebase session cookies are minted by calling createSessionCookie() after a client sends an ID token to a trusted endpoint. The Admin SDK validates the expiresIn value and the documentation only allows durations between 5 minutes and 2 weeks (in milliseconds). Passing a value outside this window—missing the option entirely, using the wrong units, or setting zero/negative values—triggers auth/invalid-session-cookie-duration before the cookie is created.
How do I fix "auth/invalid-session-cookie-duration"?
The Firebase Admin SDK enforces session cookies to last between five minutes and two weeks, so creating a session cookie with a shorter or longer duration fails with this error and prevents the login endpoint from issuing authenticated cookies.
What causes "auth/invalid-session-cookie-duration"?
expiresIn is undefined, null or zero because the client never included a duration. The duration is supplied in seconds (or minutes) and is accidentally inflated beyond two weeks when converted to milliseconds. A test value under five minutes (e.g., 60 seconds) is passed and the SDK rejects it.
Is the "auth/invalid-session-cookie-duration" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading