{"record":{"id":"142352c4cc88251f","repo":"nextauthjs/next-auth","slug":"invalid-cookie","errorCode":null,"errorMessage":"Invalid cookie","messagePattern":"Invalid cookie","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/core/src/lib/actions/callback/oauth/checks.ts","lineNumber":74,"sourceCode":"  return { name: cookie.name, value: encoded, options: cookieOptions }\n}\n\nasync function parseCookie(\n  name: keyof CookiesOptions,\n  value: string | undefined,\n  options: InternalOptions\n): Promise<string> {\n  try {\n    const { logger, cookies, jwt } = options\n    logger.debug(`PARSE_${name.toUpperCase()}`, { cookie: value })\n\n    if (!value) throw new InvalidCheck(`${name} cookie was missing`)\n    const parsed = await decode<CookiePayload>({\n      ...jwt,\n      token: value,\n      salt: cookies[name].name,\n    })\n    if (!parsed?.value) throw new Error(\"Invalid cookie\")\n    // The check must have been created by the provider currently handling\n    // the callback.\n    if (parsed.provider !== options.provider?.id) {\n      throw new Error(\n        `${name} cookie was created for a different provider than the one handling the callback`\n      )\n    }\n    return parsed.value\n  } catch (error) {\n    throw new InvalidCheck(`${name} value could not be parsed`, {\n      cause: error,\n    })\n  }\n}\n\nfunction clearCookie(\n  name: keyof CookiesOptions,\n  options: InternalOptions,","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/lib/actions/callback/oauth/checks.ts#L56-L92","documentation":"parseCookie throws \"Invalid cookie\" when the check cookie exists but decoding it yields no `value` payload — i.e. the JWT-decoded cookie payload is empty or malformed. This is an internal consistency check after JWT decode with the configured secret and cookie-name salt.","triggerScenarios":"Cookie value present at callback but decode() returns null/undefined or an object without `value`, typically because the cookie was tampered with, encrypted with a different AUTH_SECRET, or truncated/truncated by a proxy with header size limits.","commonSituations":"AUTH_SECRET changed between sign-in start and callback (deploy mid-flow, multiple instances with different secrets); load balancer sending the callback to a server with a different secret; cookie mangled by middleware rewriting headers.","solutions":["Ensure all instances use the same stable AUTH_SECRET (set it explicitly in env, not generated per-instance).","Complete sign-in flows across deploys; old in-flight sessions become invalid after a secret rotation — start the flow again.","Inspect the cookie in devtools: if it's truncated or garbage, check proxy header limits and middleware interference.","Restart the sign-in flow to get a fresh cookie set."],"exampleFix":"// before: random secret per instance breaks decode\nconst secret = crypto.randomBytes(32).toString(\"hex\")\n// after: shared stable secret\nexport const { handlers } = NextAuth({\n  secret: process.env.AUTH_SECRET,\n  providers: [],\n})","handlingStrategy":"try-catch","validationCode":"if (!process.env.AUTH_SECRET) {\n  throw new Error(\"AUTH_SECRET must be set explicitly and shared by all instances\")\n}","typeGuard":"function isCookiePayload(v: unknown): v is { value: string; provider?: string } {\n  return typeof v === \"object\" && v !== null && \"value\" in v\n}","tryCatchPattern":"try {\n  await auth()\n} catch (e) {\n  if (e?.message?.includes(\"Invalid cookie\")) {\n    // secret mismatch or corrupted cookie: force a new sign-in\n  }\n}","preventionTips":["Set one fixed AUTH_SECRET across all servers and environments","Expect in-flight sign-ins to break after secret rotation and have users retry","Check middleware/proxies for cookie truncation or rewriting"],"tags":["oauth","cookies","jwt-decode","secret-mismatch"],"backgroundTag":"jwt-decode-failed","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}