{"record":{"id":"723ee1cf83371bc3","repo":"plandex-ai/plandex","slug":"error-setting-auth-cookie-v","errorCode":null,"errorMessage":"error setting auth cookie: %v","messagePattern":"error setting auth cookie: (.+?)","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"app/server/handlers/auth_helpers.go","lineNumber":420,"sourceCode":"\t\t\tif org.Id == signInCodeOrgId {\n\t\t\t\tfilteredOrgs = append(filteredOrgs, org)\n\t\t\t}\n\t\t}\n\t\torgs = filteredOrgs\n\t}\n\n\t// with a single org, set the orgId in the cookie\n\t// otherwise, the user will be prompted to select an org\n\tvar orgId string\n\tif len(orgs) == 1 {\n\t\torgId = orgs[0].Id\n\t}\n\n\tlog.Println(\"Setting auth cookie if browser\")\n\terr = SetAuthCookieIfBrowser(w, r, user, token, orgId)\n\tif err != nil {\n\t\tlog.Printf(\"Error setting auth cookie: %v\\n\", err)\n\t\treturn nil, fmt.Errorf(\"error setting auth cookie: %v\", err)\n\t}\n\n\tapiOrgs, apiErr := toApiOrgs(orgs)\n\n\tif apiErr != nil {\n\t\tlog.Printf(\"Error converting orgs to api orgs: %v\\n\", apiErr)\n\t\treturn nil, fmt.Errorf(\"error converting orgs to api orgs: %v\", apiErr)\n\t}\n\n\tresp := shared.SessionResponse{\n\t\tUserId:      user.Id,\n\t\tToken:       token,\n\t\tEmail:       user.Email,\n\t\tUserName:    user.Name,\n\t\tOrgs:        apiOrgs,\n\t\tIsLocalMode: os.Getenv(\"GOENV\") == \"development\" && os.Getenv(\"LOCAL_MODE\") == \"1\",\n\t}\n","sourceCodeStart":402,"sourceCodeEnd":438,"githubUrl":"https://github.com/plandex-ai/plandex/blob/e2d772072efadbe41d2946d97d79be55532dbab5/app/server/handlers/auth_helpers.go#L402-L438","documentation":"ValidateAndSignIn fails when SetAuthCookieIfBrowser errors after successful credential validation. Cookie signing/serialization failed, so the session cannot be established for browser clients even though the user is authenticated.","triggerScenarios":"SignInHandler calls ValidateAndSignIn over a browser request; SetAuthCookieIfBrowser errors — e.g. no/invalid cookie store, secure-cookie/HTTPS mismatch, missing request context, or failure generating the cookie value.","commonSituations":"Cookie store key misconfigured or rotated; serving over plain HTTP while cookies require secure=true; behind a proxy that breaks TLS/headers; misconfigured cookie domain in multi-domain deployments.","solutions":["Inspect the wrapped %v cause from SetAuthCookieIfBrowser","Verify cookie store signing key configuration is present and consistent across replicas","Ensure HTTPS is used when secure cookies are required, or fix TLS termination at the proxy","Check cookie domain/path settings match the deployment host"],"exampleFix":"// before\nerr = SetAuthCookieIfBrowser(w, r, user, token, orgId)\nif err != nil {\n\treturn nil, fmt.Errorf(\"error setting auth cookie: %v\", err)\n}\n// after\nerr = SetAuthCookieIfBrowser(w, r, user, token, orgId)\nif err != nil {\n\tlog.Printf(\"SetAuthCookieIfBrowser failed: %v\", err)\n\treturn nil, fmt.Errorf(\"error setting auth cookie: %v\", err)\n}","handlingStrategy":"try-catch","validationCode":"// verify cookie prerequisites before sign-in\nif cookieStoreKey == nil {\n\treturn errors.New(\"cookie store signing key not configured\")\n}","typeGuard":null,"tryCatchPattern":"user, err := ValidateAndSignIn(w, r, req)\nif err != nil {\n\tif strings.HasPrefix(err.Error(), \"error setting auth cookie\") {\n\t\t// token may still be valid — fall back to header-based auth\n\t\thttp.Error(w, \"session established but cookie failed; use bearer token\", http.StatusInternalServerError)\n\t\treturn\n\t}\n\thttp.Error(w, err.Error(), http.StatusUnauthorized)\n}","preventionTips":["Use HTTPS wherever secure cookies are required","Keep cookie signing keys consistent across all replicas","Fix proxy/TLS termination so secure-cookie checks pass","Test cookie flows behind load balancers and reverse proxies"],"tags":["auth","cookies","session"],"backgroundTag":"auth-cookie-failed","analyzedSha":"e2d772072efadbe41d2946d97d79be55532dbab5","analyzedAt":"2026-09-05T20:56:53.631Z","contentChangedAt":"2026-09-05T20:56:53.631Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}