What causes "Unable to fetch datasource auth cookie" in Budibase/budibase?

Ensure the flow always begins at the preAuth endpoint so the DatasourceAuth cookie is set

Unable to fetch datasource auth cookie

Error message

Unable to fetch datasource auth cookie

What it means

postAuth in the Google datasource passport flow reads the DatasourceAuth state cookie that preAuth set, and throws when the cookie is absent. The cookie carries the appId/state needed to complete OAuth, so without it the callback cannot proceed.

Source

Thrown at packages/backend-core/src/middleware/passport/datasource/google.ts:67

}

export async function postAuth(
  passport: Passport,
  ctx: UserCtx,
  next: Function
) {
  // get the relevant config
  const config = await fetchGoogleCreds()
  const platformUrl = await configs.getPlatformUrl({ tenantAware: false })

  let callbackUrl = `${platformUrl}/api/global/auth/datasource/google/callback`
  const authStateCookie = utils.getCookie<{ appId: string }>(
    ctx,
    Cookie.DatasourceAuth
  )

  if (!authStateCookie) {
    throw new Error("Unable to fetch datasource auth cookie")
  }

  return passport.authenticate(
    new GoogleStrategy(
      {
        clientID: config.clientID,
        clientSecret: config.clientSecret,
        callbackURL: callbackUrl,
      },
      (
        accessToken: string,
        refreshToken: string,
        _profile: SSOProfile,
        done: Function
      ) => {
        utils.clearCookie(ctx, Cookie.DatasourceAuth)
        done(null, { accessToken, refreshToken })
      }

View on GitHub (pinned to a81a902e9a)

Solutions

Ensure the flow always begins at the preAuth endpoint so the DatasourceAuth cookie is set
Enable cookies for the builder/proxy domain (check SameSite/Secure settings and HTTPS)
Verify nginx/proxy is not stripping cookies on the callback route
Complete the OAuth flow promptly — restart from preAuth if the session expired
Make sure preAuth and callback share the same host/domain

Example fix

// before
// calling postAuth callback directly without preAuth
await google.postAuth(ctx, passport)
// after
// route the user through preAuth first: GET /datasources/google/auth -> callback
router.get("/datasources/google/auth", async ctx => {
  await google.preAuth(passport, ctx)
})

Defensive patterns

Strategy: fallback

Validate before calling

const state = utils.getCookie(ctx, Cookie.DatasourceAuth)
if (!state) throw new Error("OAuth state cookie missing — restart flow from preAuth")

Try / catch

try {
  await google.postAuth(ctx, passport)
} catch (e) {
  if (e.message === "Unable to fetch datasource auth cookie") {
    return ctx.redirect(googleDatasourceAuthUrl) // restart OAuth from preAuth
  }
  throw e
}

Prevention

Always start OAuth at preAuth, never at the callback URL directly
Configure SameSite=None; Secure cookies behind HTTPS for cross-domain callbacks
Ensure proxies don't strip Set-Cookie on callback routes
Shorten the gap between auth start and callback to avoid expiry

When it happens

Trigger: Hitting the OAuth callback without having gone through preAuth, cookies blocked/stripped by the browser or proxy, cookie expiring, or the callback occurring on a different domain than the preAuth request.

Common situations: Third-party cookie blocking in browsers (Safari); opening the callback URL directly; SameSite/proxy config stripping Set-Cookie; session timeout between authorize and callback steps.

Related errors

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/7f8e33ca83e69e62. Report an issue: GitHub.