{"record":{"id":"42062fddb37f15b8","repo":"nextauthjs/next-auth","slug":"option-path-is-invalid-options-path","errorCode":null,"errorMessage":"option path is invalid: ${options.path}","messagePattern":"option path is invalid: (.+?)","errorType":"exception","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"packages/core/src/lib/vendored/cookie.ts","lineNumber":292,"sourceCode":"  if (options.maxAge !== undefined) {\n    if (!Number.isInteger(options.maxAge)) {\n      throw new TypeError(`option maxAge is invalid: ${options.maxAge}`)\n    }\n\n    str += \"; Max-Age=\" + options.maxAge\n  }\n\n  if (options.domain) {\n    if (!domainValueRegExp.test(options.domain)) {\n      throw new TypeError(`option domain is invalid: ${options.domain}`)\n    }\n\n    str += \"; Domain=\" + options.domain\n  }\n\n  if (options.path) {\n    if (!pathValueRegExp.test(options.path)) {\n      throw new TypeError(`option path is invalid: ${options.path}`)\n    }\n\n    str += \"; Path=\" + options.path\n  }\n\n  if (options.expires) {\n    if (\n      !isDate(options.expires) ||\n      !Number.isFinite(options.expires.valueOf())\n    ) {\n      throw new TypeError(`option expires is invalid: ${options.expires}`)\n    }\n\n    str += \"; Expires=\" + options.expires.toUTCString()\n  }\n\n  if (options.httpOnly) {\n    str += \"; HttpOnly\"","sourceCodeStart":274,"sourceCodeEnd":310,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/lib/vendored/cookie.ts#L274-L310","documentation":"serialize() validates the optional `path` option against pathValueRegExp before appending `; Path=`. If the value contains characters not permitted in a cookie path attribute (per RFC 6265 path-value grammar), a TypeError is thrown. This prevents emitting a Set-Cookie header the browser would reject or misinterpret.","triggerScenarios":"Calling serialize(name, val, { path: '/app; Path=/' }) or any path containing forbidden characters such as spaces, semicolons, quotes, control characters, or a full URL instead of a path.","commonSituations":"Building the path from user input or route segments without encoding; accidentally passing a full URL ('https://example.com/app'); template-string mistakes that inject extra attributes into the path value; trailing whitespace from config files.","solutions":["Pass a plain path string starting with '/', typically path: '/'","Trim the configured value and encode or strip illegal characters before passing it","Use new URL(base).pathname to extract just the path portion of a URL","Validate against a path-value regex before calling serialize"],"exampleFix":"// before\nserialize('sid', val, { path: process.env.BASE_PATH }) // ' /app '\n// after\nserialize('sid', val, { path: (process.env.BASE_PATH || '/').trim() })","handlingStrategy":"validation","validationCode":"function isValidCookiePath(p) {\n  return typeof p === 'string' && p.length > 0 && !/[;\\s\",\\\\]/.test(p)\n}\nif (opts.path && !isValidCookiePath(opts.path)) throw new TypeError(`option path is invalid: ${opts.path}`)","typeGuard":"function isCookiePath(v: unknown): v is string {\n  return typeof v === 'string' && v.startsWith('/') && !/[;\\s\",\\\\]/.test(v)\n}","tryCatchPattern":"let cookie\ntry {\n  cookie = serialize('sid', val, { path })\n} catch (err) {\n  if (err instanceof TypeError && err.message.startsWith('option path is invalid')) {\n    throw new ConfigError(`Bad cookie path '${path}' — must be a plain path like '/app'`)\n  }\n  throw err\n}","preventionTips":["Default to path: '/' unless you specifically need scoping","Extract paths with new URL(x).pathname instead of hand-built strings","Trim config values and strip semicolons/whitespace before use","Never interpolate extra '; Attribute=' pairs inside the path value"],"tags":["cookie","validation","typeerror","serialize"],"backgroundTag":"invalid-cookie-attribute","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}