{"record":{"id":"ae7f03e5f900494f","repo":"nextauthjs/next-auth","slug":"option-samesite-is-invalid-options-samesite","errorCode":null,"errorMessage":"option sameSite is invalid: ${options.sameSite}","messagePattern":"option sameSite is invalid: (.+?)","errorType":"exception","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"packages/core/src/lib/vendored/cookie.ts","lineNumber":358,"sourceCode":"\n  if (options.sameSite) {\n    const sameSite =\n      typeof options.sameSite === \"string\"\n        ? options.sameSite.toLowerCase()\n        : options.sameSite\n    switch (sameSite) {\n      case true:\n      case \"strict\":\n        str += \"; SameSite=Strict\"\n        break\n      case \"lax\":\n        str += \"; SameSite=Lax\"\n        break\n      case \"none\":\n        str += \"; SameSite=None\"\n        break\n      default:\n        throw new TypeError(`option sameSite is invalid: ${options.sameSite}`)\n    }\n  }\n\n  return str\n}\n\n/**\n * URL-decode string value. Optimized to skip native call when no %.\n */\nfunction decode(str: string): string {\n  if (str.indexOf(\"%\") === -1) return str\n\n  try {\n    return decodeURIComponent(str)\n  } catch (e) {\n    return str\n  }\n}","sourceCodeStart":340,"sourceCodeEnd":376,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/lib/vendored/cookie.ts#L340-L376","documentation":"serialize() accepts `sameSite` only as true, 'strict', 'lax', or 'none' (strings are matched case-insensitively after lowercasing). Any other truthy value — e.g. 'default', a number, or a random string — hits the default branch and throws a TypeError. SameSite is a closed enum in the cookie spec, so the library fails fast rather than emitting an attribute browsers would ignore.","triggerScenarios":"serialize(name, val, { sameSite: 'default' }), { sameSite: 'auto' }, { sameSite: 1 }, or copying a SameSite value from another framework that uses different casing/values not in the accepted set.","commonSituations":"Migrating from older cookie libs whose enum included 'none' variants or 'unspecified'; reading sameSite from config/env where authors wrote 'no_restriction' or 'strict_but_ok'; passing the browser's parsed SameSite string in unexpected form; typos like 'laxt'.","solutions":["Use one of: true/'strict', 'lax', or 'none' (case-insensitive)","Remember SameSite=None additionally requires the Secure attribute in modern browsers","Add a TS union type: sameSite?: true | 'strict' | 'lax' | 'none' to catch bad values at compile time","Map external frameworks' values to this library's accepted set before calling serialize"],"exampleFix":"// before\nserialize('sid', val, { sameSite: 'unspecified' })\n// after\nserialize('sid', val, { sameSite: 'lax' })","handlingStrategy":"type-guard","validationCode":"const SAME_SITE = new Set(['strict', 'lax', 'none', 'true'])\nfunction isValidSameSite(v) {\n  if (v === true) return true\n  return typeof v === 'string' && SAME_SITE.has(v.toLowerCase())\n}\nif (opts.sameSite && !isValidSameSite(opts.sameSite)) throw new TypeError(`option sameSite is invalid: ${opts.sameSite}`)","typeGuard":"type SameSite = true | 'strict' | 'lax' | 'none'\nfunction isSameSite(v: unknown): v is SameSite {\n  return v === true || (typeof v === 'string' && ['strict', 'lax', 'none'].includes(v.toLowerCase()))\n}","tryCatchPattern":"let cookie\ntry {\n  cookie = serialize('sid', val, { sameSite })\n} catch (err) {\n  if (err instanceof TypeError && err.message.startsWith('option sameSite is invalid')) {\n    throw new ConfigError(`Invalid sameSite '${sameSite}' — use strict, lax, or none`)\n  }\n  throw err\n}","preventionTips":["Use the TS union type sameSite?: true | 'strict' | 'lax' | 'none'","Pair SameSite='none' with secure: true or browsers reject the cookie","Map values from other frameworks/env config to this enum before calling serialize","Write a startup check that validates all configured cookie attributes once, not per-request"],"tags":["cookie","validation","typeerror","serialize","samesite"],"backgroundTag":"invalid-cookie-attribute","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}