{"record":{"id":"ae3ffbcc5f7c69ae","repo":"nextauthjs/next-auth","slug":"name-cookie-was-missing","errorCode":null,"errorMessage":"${name} cookie was missing","messagePattern":"(.+?) cookie was missing","errorType":"exception","errorClass":"InvalidCheck","httpStatus":null,"severity":"error","filePath":"packages/core/src/lib/actions/callback/oauth/checks.ts","lineNumber":68,"sourceCode":"      value: payload,\n      provider: options.provider.id,\n    } satisfies CookiePayload,\n    salt: cookie.name,\n  })\n  const cookieOptions = { ...cookie.options, expires }\n  return { name: cookie.name, value: encoded, options: cookieOptions }\n}\n\nasync function parseCookie(\n  name: keyof CookiesOptions,\n  value: string | undefined,\n  options: InternalOptions\n): Promise<string> {\n  try {\n    const { logger, cookies, jwt } = options\n    logger.debug(`PARSE_${name.toUpperCase()}`, { cookie: value })\n\n    if (!value) throw new InvalidCheck(`${name} cookie was missing`)\n    const parsed = await decode<CookiePayload>({\n      ...jwt,\n      token: value,\n      salt: cookies[name].name,\n    })\n    if (!parsed?.value) throw new Error(\"Invalid cookie\")\n    // The check must have been created by the provider currently handling\n    // the callback.\n    if (parsed.provider !== options.provider?.id) {\n      throw new Error(\n        `${name} cookie was created for a different provider than the one handling the callback`\n      )\n    }\n    return parsed.value\n  } catch (error) {\n    throw new InvalidCheck(`${name} value could not be parsed`, {\n      cause: error,\n    })","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/lib/actions/callback/oauth/checks.ts#L50-L86","documentation":"parseCookie throws InvalidCheck with \"<name> cookie was missing\" when the OAuth state/PKCE/nonce cookie expected at the callback is absent. These cookies are set during sign-in and must round-trip through the provider; their absence means the CSRF/state check cannot be validated.","triggerScenarios":"Callback request arrives with no state (or pkce/nonce) cookie while the provider is configured with checks: [\"state\"] / [\"pkce\"]; cookies stripped by the browser or proxy; user opened the provider's login page in a different browser/profile than the one the cookie was set in.","commonSituations":"Cookie Secure/SameSite settings blocking cookies on http://localhost across ports; ITP/Safari partitioned cookies on cross-site redirects; reverse proxy not forwarding Set-Cookie/Cookie headers; AUTH_URL/redirect URI scheme mismatch (https callback served over http).","solutions":["Ensure AUTH_URL (or the configured redirect origin) matches the actual URL scheme/host so cookies aren't rejected as Secure.","Test in a normal browser window without privacy mode; verify cookies survive the provider redirect round trip.","Check any proxy/CDN isn't stripping Set-Cookie or Cookie headers; forward cookies correctly.","If behind HTTPS termination, set trustHost correctly and use AUTH_URL=https://... to keep Secure cookies valid.","Restart the sign-in flow from your app instead of reusing an old authorization URL bookmarked from a previous attempt."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const cb = new URL(callbackUrl)\nconst configured = new URL(process.env.AUTH_URL!)\nif (cb.protocol !== configured.protocol || cb.host !== configured.host) {\n  console.warn(\"Callback origin differs from AUTH_URL; cookies may be dropped\")\n}","typeGuard":"function cookiePresent(req: Request, name: string): boolean {\n  return req.headers.get(\"cookie\")?.split(\";\").some(c => c.trim().startsWith(name + \"=\")) ?? false\n}","tryCatchPattern":"try {\n  await signIn(\"provider\")\n} catch (e) {\n  if (e?.message?.includes(\"cookie was missing\")) {\n    // advise enabling cookies / restarting the sign-in flow\n  }\n}","preventionTips":["Keep AUTH_URL in sync with the real scheme/host (especially behind proxies)","Test the full redirect round trip in the browsers you support (Safari/ITP included)","Confirm proxies forward Cookie and Set-Cookie headers untouched","Don't bookmark or reuse old authorization URLs"],"tags":["oauth","cookies","state-validation","csrf"],"backgroundTag":"oauth-state-cookie-missing","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}