diff --git a/app-config.yaml b/app-config.yaml
index 8dc870a7cd..fcc54a1a35 100644
--- a/app-config.yaml
+++ b/app-config.yaml
@@ -189,10 +189,10 @@ scaffolder:
     api:
       token:
         $env: AZURE_TOKEN
-
 auth:
-  session:
-    secret: yaml session secret
+  ### Providing an auth.session.secret will enable session support in the auth-backend
+  # session:
+  #   secret: custom session secret
   providers:
     google:
       development:
diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts
index 1baa1d4892..47e0d14caa 100644
--- a/plugins/auth-backend/src/service/router.ts
+++ b/plugins/auth-backend/src/service/router.ts
@@ -28,6 +28,7 @@ import { Logger } from 'winston';
 import { createOidcRouter, DatabaseKeyStore, TokenFactory } from '../identity';
 import { createAuthProvider } from '../providers';
 import session from 'express-session';
+import passport from 'passport';
 
 export interface RouterOptions {
   logger: Logger;
@@ -60,11 +61,16 @@ export async function createRouter({
   });
   const catalogApi = new CatalogClient({ discoveryApi: discovery });
 
-  const secret =
-    config.getOptionalString('auth.session.secret') ?? 'backstage secret';
-  console.log('using secret', secret);
-  router.use(cookieParser(secret));
-  router.use(session({ secret, saveUninitialized: false, resave: false }));
+  const secret = config.getOptionalString('auth.session.secret');
+  if (secret) {
+    router.use(cookieParser(secret));
+    // TODO: Configure the server-side session storage.  The default MemoryStore is not designed for production
+    router.use(session({ secret, saveUninitialized: false, resave: false }));
+    router.use(passport.initialize());
+    router.use(passport.session());
+  } else {
+    router.use(cookieParser());
+  }
   router.use(express.urlencoded({ extended: false }));
   router.use(express.json());