{"record":{"id":"7b2d0455976b84a6","repo":"sveltejs/kit","slug":"cookies-set-in-remote-functions-must-have-an-absol","errorCode":null,"errorMessage":"Cookies set in remote functions must have an absolute path","messagePattern":"Cookies set in remote functions must have an absolute path","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/kit/src/runtime/app/server/remote/shared.js","lineNumber":97,"sourceCode":" * @param {boolean} allow_cookies\n * @returns {RequestStore}\n */\nfunction derive_remote_function_event(event, state, allow_cookies) {\n\t/** @type {RequestEvent} */\n\tconst derived = {\n\t\t...event,\n\t\tsetHeaders: () => {\n\t\t\tthrow new Error('setHeaders is not allowed in remote functions');\n\t\t},\n\t\tcookies: {\n\t\t\t...event.cookies,\n\t\t\tset: (name, value, opts) => {\n\t\t\t\tif (!allow_cookies) {\n\t\t\t\t\tthrow new Error('Cannot set cookies in `query` or `prerender` functions');\n\t\t\t\t}\n\n\t\t\t\tif (opts.path && !opts.path.startsWith('/')) {\n\t\t\t\t\tthrow new Error('Cookies set in remote functions must have an absolute path');\n\t\t\t\t}\n\n\t\t\t\treturn event.cookies.set(name, value, opts);\n\t\t\t},\n\t\t\tdelete: (name, opts) => {\n\t\t\t\tif (!allow_cookies) {\n\t\t\t\t\tthrow new Error('Cannot delete cookies in `query` or `prerender` functions');\n\t\t\t\t}\n\n\t\t\t\tif (opts.path && !opts.path.startsWith('/')) {\n\t\t\t\t\tthrow new Error('Cookies deleted in remote functions must have an absolute path');\n\t\t\t\t}\n\n\t\t\t\treturn event.cookies.delete(name, opts);\n\t\t\t}\n\t\t}\n\t};\n","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/sveltejs/kit/blob/03f1687fe612ce3d2d9131139b5b188d9cf90c64/packages/kit/src/runtime/app/server/remote/shared.js#L79-L115","documentation":"Remote function responses don't have a request URL context you can resolve relative cookie paths against, so any cookie `path` option passed from a remote function must be an absolute path starting with `/`. A relative or bare path makes the Set-Cookie header ambiguous, so SvelteKit throws.","triggerScenarios":"Calling `event.cookies.set(name, value, { path: 'sub' })` or `{ path: '' }` (falsy values skip the check; relative paths trigger it) inside any remote function's cookies.set/delete.","commonSituations":"Copy-pasting cookie code from middleware frameworks that allow relative paths; building the path from a variable that isn't rooted; assuming the default page path applies.","solutions":["Always pass an absolute path: `{ path: '/' }` for site-wide cookies.","Omit the `path` option entirely to use SvelteKit's default.","Prefix computed paths with '/' if they may be relative, or validate them before calling set()."],"exampleFix":"// before\nevent.cookies.set('session', token, { path: 'account' });\n// after\nevent.cookies.set('session', token, { path: '/account' });","handlingStrategy":"validation","validationCode":"function cookieOpts(opts = {}) {\n  const path = opts.path ? (opts.path.startsWith('/') ? opts.path : '/' + opts.path) : undefined;\n  return { ...opts, path };\n}\nevent.cookies.set(name, value, cookieOpts(opts));","typeGuard":"function hasAbsolutePath(opts) { return !opts.path || opts.path.startsWith('/'); }","tryCatchPattern":"try {\n  event.cookies.set(name, value, opts);\n} catch (e) {\n  if (e.message.includes('absolute path')) event.cookies.set(name, value, { ...opts, path: '/' });\n  else throw e;\n}","preventionTips":["Always use explicit absolute paths ('/') for cookies set in remote functions.","Normalize any dynamic path with a leading '/' before calling set/delete.","Prefer omitting `path` to inherit SvelteKit's default."],"tags":["remote-functions","cookies","validation"],"backgroundTag":"cookie-path-must-be-absolute","analyzedSha":"03f1687fe612ce3d2d9131139b5b188d9cf90c64","analyzedAt":"2026-09-02T02:01:50.504Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}