{"record":{"id":"2a72cf0b9fbd5550","repo":"nextauthjs/next-auth","slug":"argument-name-is-invalid-name","errorCode":null,"errorMessage":"argument name is invalid: ${name}","messagePattern":"argument name is invalid: (.+?)","errorType":"exception","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"packages/core/src/lib/vendored/cookie.ts","lineNumber":262,"sourceCode":"\n/**\n * Serialize data into a cookie header.\n *\n * Serialize a name value pair into a cookie string suitable for\n * http headers. An optional options object specifies cookie parameters.\n *\n * serialize('foo', 'bar', { httpOnly: true })\n *   => \"foo=bar; httpOnly\"\n */\nexport function serialize(\n  name: string,\n  val: string,\n  options?: SerializeOptions\n): string {\n  const enc = options?.encode || encodeURIComponent\n\n  if (!cookieNameRegExp.test(name)) {\n    throw new TypeError(`argument name is invalid: ${name}`)\n  }\n\n  const value = enc(val)\n\n  if (!cookieValueRegExp.test(value)) {\n    throw new TypeError(`argument val is invalid: ${val}`)\n  }\n\n  let str = name + \"=\" + value\n  if (!options) return str\n\n  if (options.maxAge !== undefined) {\n    if (!Number.isInteger(options.maxAge)) {\n      throw new TypeError(`option maxAge is invalid: ${options.maxAge}`)\n    }\n\n    str += \"; Max-Age=\" + options.maxAge\n  }","sourceCodeStart":244,"sourceCodeEnd":280,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/lib/vendored/cookie.ts#L244-L280","documentation":"The vendored cookie `serialize` function validates the cookie name against cookieNameRegExp before writing the Set-Cookie header. Names must be valid HTTP header tokens (no separators, spaces, control chars, or non-ASCII). A TypeError is thrown immediately rather than emitting a malformed cookie.","triggerScenarios":"Calling serialize(name, val, options) where `name` fails cookieNameRegExp — e.g. contains spaces, semicolons, equals signs, quotes, commas, or non-ASCII characters.","commonSituations":"Deriving a cookie name from user input or a dynamic key (tenant id, session prefix) that contains illegal characters; a typo like \"session id\" instead of \"session.id\"; framework-internal code passing an undefined/empty name after a refactor.","solutions":["Fix the cookie name to contain only valid token characters (ASCII letters, digits, and !#$%&'*+-.^_`|~).","If a dynamic suffix is needed, encode or sanitize it first (e.g. encodeURIComponent the value used inside the name, or use a safe separator).","Validate/strip user-derived segments before using them as cookie names.","Check upstream callers to find where the bad name originates and reject it earlier."],"exampleFix":"// before\nres.setHeader(\"Set-Cookie\", serialize(`session ${tenantId}`, token))\n// after\nconst safeTenant = encodeURIComponent(tenantId)\nres.setHeader(\"Set-Cookie\", serialize(`session.${safeTenant}`, token))","handlingStrategy":"validation","validationCode":"const COOKIE_NAME_RE = /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/\nif (!COOKIE_NAME_RE.test(name)) throw new Error(`Refusing invalid cookie name: ${JSON.stringify(name)}`)","typeGuard":"function isValidCookieName(name: unknown): name is string {\n  return typeof name === \"string\" && /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/.test(name)\n}","tryCatchPattern":"try {\n  return serialize(name, value, opts)\n} catch (e) {\n  if (e instanceof TypeError && e.message.startsWith(\"argument name is invalid\")) {\n    return serialize(sanitizeCookieName(name), value, opts)\n  }\n  throw e\n}","preventionTips":["Use only fixed, literal cookie names in application code","Sanitize/encode any dynamic segments before embedding them in cookie names","Reject or slugify user-derived input before it reaches cookie naming","Add a unit test asserting generated cookie names match the valid-token charset"],"tags":["cookie","validation","typeerror","http-headers"],"backgroundTag":"invalid-cookie-name","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}