{"record":{"id":"a58b4be7341f06a4","repo":"sveltejs/kit","slug":"cannot-set-cookies-in-query-or-prerender-funct","errorCode":null,"errorMessage":"Cannot set cookies in `query` or `prerender` functions","messagePattern":"Cannot set cookies in `query` or `prerender` functions","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/kit/src/runtime/app/server/remote/shared.js","lineNumber":93,"sourceCode":"\n/**\n * @param {RequestEvent} event\n * @param {RequestState} state\n * @param {boolean} allow_cookies\n * @returns {RequestStore}\n */\nfunction derive_remote_function_event(event, state, allow_cookies) {\n\t/** @type {RequestEvent} */\n\tconst derived = {\n\t\t...event,\n\t\tsetHeaders: () => {\n\t\t\tthrow new Error('setHeaders is not allowed in remote functions');\n\t\t},\n\t\tcookies: {\n\t\t\t...event.cookies,\n\t\t\tset: (name, value, opts) => {\n\t\t\t\tif (!allow_cookies) {\n\t\t\t\t\tthrow new Error('Cannot set cookies in `query` or `prerender` functions');\n\t\t\t\t}\n\n\t\t\t\tif (opts.path && !opts.path.startsWith('/')) {\n\t\t\t\t\tthrow new Error('Cookies set in remote functions must have an absolute path');\n\t\t\t\t}\n\n\t\t\t\treturn event.cookies.set(name, value, opts);\n\t\t\t},\n\t\t\tdelete: (name, opts) => {\n\t\t\t\tif (!allow_cookies) {\n\t\t\t\t\tthrow new Error('Cannot delete cookies in `query` or `prerender` functions');\n\t\t\t\t}\n\n\t\t\t\tif (opts.path && !opts.path.startsWith('/')) {\n\t\t\t\t\tthrow new Error('Cookies deleted in remote functions must have an absolute path');\n\t\t\t\t}\n\n\t\t\t\treturn event.cookies.delete(name, opts);","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/sveltejs/kit/blob/03f1687fe612ce3d2d9131139b5b188d9cf90c64/packages/kit/src/runtime/app/server/remote/shared.js#L75-L111","documentation":"Cookies are a write operation on the HTTP response, and `query`/`prerender` remote functions are conceptually read-only/cached, so their derived event rejects `cookies.set`. Only `command` and `form` remote functions (those with `allow_cookies`) may set cookies.","triggerScenarios":"Calling `event.cookies.set(...)` inside a remote function declared with `.query(...)` or `.prerender(...)`, e.g. storing a preference during a read.","commonSituations":"Recording 'recently viewed' items or locale prefs inside a query; migrating code from `+page.server.js` actions into queries without realizing write restrictions differ.","solutions":["Move the cookie write into a `command` or `form` remote function and call that from the client before/after the query.","Remove the cookie mutation if the data can be kept client-side instead.","Pass the would-be cookie value as an argument to the query and persist it via a command."],"exampleFix":"// before\nexport const prefs = query((event) => {\n  event.cookies.set('theme', 'dark', { path: '/' }); // throws\n  return getPrefs();\n});\n// after\nexport const setTheme = command((event, theme) => {\n  event.cookies.set('theme', theme, { path: '/' });\n});","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  event.cookies.set('theme', value, { path: '/' });\n} catch (e) {\n  if (e.message.includes('Cannot set cookies')) {\n    // fall back to a command() call or client-side storage\n  } else throw e;\n}","preventionTips":["Treat queries/prerender functions as strictly read-only.","Do all cookie writes in command/form remote functions.","Persist user preferences via commands, then read them back in queries."],"tags":["remote-functions","cookies","queries","api-restriction"],"backgroundTag":"cookie-write-not-allowed","analyzedSha":"03f1687fe612ce3d2d9131139b5b188d9cf90c64","analyzedAt":"2026-09-02T02:01:50.504Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}