{"record":{"id":"6eb21b2e9618d3f5","repo":"nextauthjs/next-auth","slug":"cannot-handle-action-action","errorCode":null,"errorMessage":"Cannot handle action: ${action}","messagePattern":"Cannot handle action: (.+?)","errorType":"exception","errorClass":"UnknownAction","httpStatus":null,"severity":"error","filePath":"packages/core/src/lib/index.ts","lineNumber":96,"sourceCode":"        validateCSRF(action, csrfTokenVerified)\n        return await actions.session(\n          options,\n          sessionStore,\n          cookies,\n          true,\n          request.body?.data\n        )\n      case \"signin\":\n        validateCSRF(action, csrfTokenVerified)\n        return await actions.signIn(request, cookies, options)\n\n      case \"signout\":\n        validateCSRF(action, csrfTokenVerified)\n        return await actions.signOut(cookies, sessionStore, options)\n      default:\n    }\n  }\n  throw new UnknownAction(`Cannot handle action: ${action}`)\n}\n","sourceCodeStart":78,"sourceCodeEnd":98,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/lib/index.ts#L78-L98","documentation":"AuthInternal's action router throws UnknownAction when the requested action does not match any case in its switch (session, signout, etc.). It means the URL was parsed to an action string the core runtime cannot dispatch. This is the terminal guard after the switch statement in the auth internal handler.","triggerScenarios":"Calling an endpoint like /auth/<action> whose action passed isAuthAction() parsing but has no switch case handled by the installed AuthInternal version (e.g. an action added in a newer @auth/core than the framework adapter, or an unmatched case after CSRF/session branches fall through).","commonSituations":"Version mismatch between the framework adapter (next-auth, sveltekit-auth) and @auth/core; typos in custom proxy/routing that pass an unexpected action string; calling endpoints like /auth/diagnostics that only exist in some builds.","solutions":["Align the versions of @auth/core and your framework adapter (upgrade or downgrade together)","Check the exact URL path being requested and only use documented auth endpoints (signin, signout, callback, session, csrf, providers, error)","If behind a custom proxy, ensure it forwards the original pathname unmodified"],"exampleFix":"// before\nauth: import { Auth } from \"@auth/core\" // 0.10.0 with next-auth@5.0.0-beta.4\n// after\npnpm up @auth/core@latest next-auth@latest  # keep them on compatible versions","handlingStrategy":"try-catch","validationCode":"const KNOWN_ACTIONS = [\"signin\",\"signout\",\"callback\",\"session\",\"csrf\",\"providers\",\"error\",\"webauthn-options\"];\nif (!KNOWN_ACTIONS.includes(action)) throw new Error(`Skip request, unsupported action: ${action}`);","typeGuard":"function isKnownAuthAction(a: string): a is \"signin\"|\"signout\"|\"callback\"|\"session\"|\"csrf\"|\"providers\"|\"error\"|\"webauthn-options\" { return [\"signin\",\"signout\",\"callback\",\"session\",\"csrf\",\"providers\",\"error\",\"webauthn-options\"].includes(a); }","tryCatchPattern":"try { await handleAuth(req) } catch (e) { if (e instanceof UnknownAction) return new Response(\"Not Found\", { status: 404 }); throw e; }","preventionTips":["Keep @auth/core and framework adapter versions in lockstep","Only link to documented auth endpoints","Log the incoming URL when this error occurs to spot bad traffic early"],"tags":["auth","unknown-action","version-mismatch"],"backgroundTag":"unknown-auth-action","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}