{"record":{"id":"8a4465f769e6984e","repo":"hasura/graphql-engine","slug":"jwt-authorization-token-source-cookie-header-not","errorCode":null,"errorMessage":"JWT Authorization token source: Cookie header not found","messagePattern":"JWT Authorization token source: Cookie header not found","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/crates/auth/hasura-authn-jwt/src/jwt.rs","lineNumber":50,"sourceCode":"    KidHeaderNotFound,\n    #[error(\"Expected the Hasura claims to be a String when `claimsFormat` is `stringifiedJson`\")]\n    ExpectedStringifiedJson,\n    #[error(\"The default role is not present in the allowed roles\")]\n    DisallowedDefaultRole,\n    #[error(\"The specified role is not present in the allowed roles\")]\n    DisallowedRole,\n    #[error(\"Error while parsing the claims map entry: {claim_name} - {err}\")]\n    ParseClaimsMapEntryError {\n        claim_name: String,\n        err: serde_json::Error,\n    },\n    #[error(\"Expected string value for claim {claim_name}\")]\n    ClaimMustBeAString { claim_name: String },\n    #[error(\"Required claim {claim_name} not found\")]\n    RequiredClaimNotFound { claim_name: String },\n    #[error(\"JWT Authorization token source: Header name {header_name} not found.\")]\n    AuthorizationHeaderSourceNotFound { header_name: String },\n    #[error(\"JWT Authorization token source: Cookie header not found\")]\n    CookieNotFound,\n    #[error(\n        \"JWT Authorization token source: cookie name {cookie_name} not found in the Cookie header\"\n    )]\n    CookieNameNotFound { cookie_name: String },\n    #[error(\"Error in parsing the {header_name} header: {err}\")]\n    AuthorizationHeaderParseError { err: String, header_name: String },\n    #[error(\"Error in parsing the Cookie header value: {err}\")]\n    CookieParseError { err: cookie::ParseError },\n    #[error(\"Missing corresponding value for the cookie with cookie name: {cookie_name}\")]\n    MissingCookieValue { cookie_name: String },\n    #[error(\"JWT validation error: {0}\")]\n    JWTValidationError(jwt::errors::Error),\n    #[error(\"Internal Error - {0}\")]\n    Internal(#[from] InternalError),\n}\n\nimpl TraceableError for Error {","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/v3/crates/auth/hasura-authn-jwt/src/jwt.rs#L32-L68","documentation":"The JWT is configured to be extracted from a cookie, but the incoming request has no `Cookie` header at all.","triggerScenarios":"Cookie-based JWT auth is enabled and the request contains no Cookie header — typical for plain API clients (curl, server-to-server) or cross-site requests where the browser drops cookies.","commonSituations":"Client not sending credentials (`credentials: 'include'` missing in fetch); SameSite/secure cookie policy blocking the cookie; testing with curl without a Cookie header; auth mode recently switched to cookie-based.","solutions":["Have the client send the auth cookie with the request (fetch: credentials:'include'; axios: withCredentials:true)","Check browser devtools to confirm the cookie is set and sent","Verify cookie SameSite/Secure/Domain attributes allow cross-origin sending","For non-browser clients, attach the cookie header manually or switch auth mode to header-based"],"exampleFix":"// before\nfetch(url)\n// after\nfetch(url, { credentials: 'include' })","handlingStrategy":"validation","validationCode":"if (!req.headers.get('cookie')) return unauthorized('no cookie header');","typeGuard":"const hasCookieHeader = (h: Headers): boolean => h.get('cookie') !== null;","tryCatchPattern":"Return 401; optionally fall back to Authorization-header auth if configured.","preventionTips":["Use credentials:'include' on cross-origin fetches","Set cookies with appropriate SameSite/Domain for your GraphQL origin"],"tags":["jwt","cookies","auth"],"backgroundTag":"missing-auth-cookie","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}