{"record":{"id":"17da4fb2bfb4820f","repo":"nextauthjs/next-auth","slug":"argument-val-is-invalid-val","errorCode":null,"errorMessage":"argument val is invalid: ${val}","messagePattern":"argument val is invalid: (.+?)","errorType":"exception","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"packages/core/src/lib/vendored/cookie.ts","lineNumber":268,"sourceCode":" *\n * serialize('foo', 'bar', { httpOnly: true })\n *   => \"foo=bar; httpOnly\"\n */\nexport function serialize(\n  name: string,\n  val: string,\n  options?: SerializeOptions\n): string {\n  const enc = options?.encode || encodeURIComponent\n\n  if (!cookieNameRegExp.test(name)) {\n    throw new TypeError(`argument name is invalid: ${name}`)\n  }\n\n  const value = enc(val)\n\n  if (!cookieValueRegExp.test(value)) {\n    throw new TypeError(`argument val is invalid: ${val}`)\n  }\n\n  let str = name + \"=\" + value\n  if (!options) return str\n\n  if (options.maxAge !== undefined) {\n    if (!Number.isInteger(options.maxAge)) {\n      throw new TypeError(`option maxAge is invalid: ${options.maxAge}`)\n    }\n\n    str += \"; Max-Age=\" + options.maxAge\n  }\n\n  if (options.domain) {\n    if (!domainValueRegExp.test(options.domain)) {\n      throw new TypeError(`option domain is invalid: ${options.domain}`)\n    }\n","sourceCodeStart":250,"sourceCodeEnd":286,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/lib/vendored/cookie.ts#L250-L286","documentation":"The vendored cookie `serialize` validates the ENCODED value against cookieValueRegExp. Cookie values may not contain spaces, commas, semicolons, backslashes, or non-ASCII characters. When the (encoded) value still contains forbidden characters, a TypeError is thrown instead of emitting a broken Set-Cookie header.","triggerScenarios":"Calling serialize(name, val) where `val` — after passing through options?.encode || encodeURIComponent — still fails cookieValueRegExp, e.g. raw values with quotes/commas, or supplying `encode: false` / a custom encode that doesn't escape reserved characters.","commonSituations":"Storing raw JSON or user text in a cookie without encoding; passing `encode: false` for performance and hitting illegal characters; encoding non-Latin text with a custom encoder that leaves non-ASCII bytes; JWTs or tokens containing characters the chosen encoder doesn't escape.","solutions":["Let the default encodeURIComponent handle encoding — remove `encode: false` or custom encoders that don't escape reserved characters.","Pre-sanitize the value: base64url-encode binary/JSON payloads before storing them in the cookie.","Use `JSON.stringify` + encodeURIComponent, or a JWT library, instead of raw multi-part values.","Use multiple smaller cookies or a session store if the value legitimately contains complex data."],"exampleFix":"// before\nserialize(\"prefs\", JSON.stringify(prefs), { encode: false })\n// after\nserialize(\"prefs\", JSON.stringify(prefs)) // default encodeURIComponent","handlingStrategy":"validation","validationCode":"const COOKIE_VALUE_RE = /^[\\u0021\\u0023-\\u005B\\u005D-\\u007E]*$/\nconst encoded = encodeURIComponent(value)\nif (!COOKIE_VALUE_RE.test(encoded)) throw new Error(`Value not cookie-safe even after encoding`)\nserialize(name, encoded, opts)","typeGuard":"function isCookieSafeValue(v: unknown): v is string {\n  return typeof v === \"string\" &&\n    /^[\\u0021\\u0023-\\u005B\\u005D-\\u007E]*$/.test(encodeURIComponent(v))\n}","tryCatchPattern":"try {\n  return serialize(name, value, opts)\n} catch (e) {\n  if (e instanceof TypeError && e.message.startsWith(\"argument val is invalid\")) {\n    return serialize(name, Buffer.from(String(value)).toString(\"base64url\"), opts)\n  }\n  throw e\n}","preventionTips":["Never pass encode: false unless you are certain values are token-safe","Base64url-encode JSON/binary payloads before storing them in cookies","Prefer JWTs or server-side sessions over raw multi-part cookie values","Keep a round-trip test: set the cookie, parse it back, assert equality"],"tags":["cookie","validation","encoding","typeerror"],"backgroundTag":"invalid-cookie-value","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}