{"record":{"id":"7a657cc663aab5ef","repo":"sveltejs/kit","slug":"cannot-delete-cookies-in-query-or-prerender-fu","errorCode":null,"errorMessage":"Cannot delete cookies in `query` or `prerender` functions","messagePattern":"Cannot delete cookies in `query` or `prerender` functions","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/kit/src/runtime/app/server/remote/shared.js","lineNumber":104,"sourceCode":"\t\tsetHeaders: () => {\n\t\t\tthrow new Error('setHeaders is not allowed in remote functions');\n\t\t},\n\t\tcookies: {\n\t\t\t...event.cookies,\n\t\t\tset: (name, value, opts) => {\n\t\t\t\tif (!allow_cookies) {\n\t\t\t\t\tthrow new Error('Cannot set cookies in `query` or `prerender` functions');\n\t\t\t\t}\n\n\t\t\t\tif (opts.path && !opts.path.startsWith('/')) {\n\t\t\t\t\tthrow new Error('Cookies set in remote functions must have an absolute path');\n\t\t\t\t}\n\n\t\t\t\treturn event.cookies.set(name, value, opts);\n\t\t\t},\n\t\t\tdelete: (name, opts) => {\n\t\t\t\tif (!allow_cookies) {\n\t\t\t\t\tthrow new Error('Cannot delete cookies in `query` or `prerender` functions');\n\t\t\t\t}\n\n\t\t\t\tif (opts.path && !opts.path.startsWith('/')) {\n\t\t\t\t\tthrow new Error('Cookies deleted in remote functions must have an absolute path');\n\t\t\t\t}\n\n\t\t\t\treturn event.cookies.delete(name, opts);\n\t\t\t}\n\t\t}\n\t};\n\n\tif (state.is_in_remote_query) {\n\t\tfor (const property of ['url', 'params', 'route']) {\n\t\t\t// non-enumerable so spreading for a nested derivation doesn't invoke the getter\n\t\t\tObject.defineProperty(derived, property, {\n\t\t\t\tenumerable: false,\n\t\t\t\tget() {\n\t\t\t\t\tthrow new Error(","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/sveltejs/kit/blob/03f1687fe612ce3d2d9131139b5b188d9cf90c64/packages/kit/src/runtime/app/server/remote/shared.js#L86-L122","documentation":"Like `cookies.set`, deleting cookies writes to the response and is forbidden in read-only `query` and `prerender` remote functions. The derived event replaces `cookies.delete` with a guard that throws when cookie writes aren't allowed.","triggerScenarios":"Calling `event.cookies.delete('session', { path: '/' })` inside a remote function declared with `.query(...)` or `.prerender(...)` — e.g. logging a user out within a query.","commonSituations":"Implementing logout/cleanup logic as a query because it 'doesn't return anything'; refactoring a `+page.server.js` load that cleared a cookie into a remote query.","solutions":["Move the deletion into a `command` (or `form`) remote function and invoke it from the client.","Remove the cookie deletion if it's unnecessary in a read path.","Client-side, call `logoutCommand()` then refetch the query instead of clearing cookies during the query itself."],"exampleFix":"// before\nexport const logout = query((event) => {\n  event.cookies.delete('session', { path: '/' }); // throws\n  return { ok: true };\n});\n// after\nexport const logout = command((event) => {\n  event.cookies.delete('session', { path: '/' });\n  return { ok: true };\n});","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  event.cookies.delete('session', { path: '/' });\n} catch (e) {\n  if (e.message.includes('Cannot delete cookies')) {\n    // defer to a command/form remote function\n  } else throw e;\n}","preventionTips":["Implement logout/cleanup as commands, not queries.","Keep query remote functions free of any cookie mutation.","Audit remote files for cookies.set/delete usage after refactors from load functions."],"tags":["remote-functions","cookies","queries","api-restriction"],"backgroundTag":"cookie-write-not-allowed","analyzedSha":"03f1687fe612ce3d2d9131139b5b188d9cf90c64","analyzedAt":"2026-09-02T02:01:50.504Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}