{"record":{"id":"c12b620b0c2b867b","repo":"nextauthjs/next-auth","slug":"data-message-c12b62","errorCode":null,"errorMessage":"data.message","messagePattern":"data\\.message","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/frameworks-qwik/src/index.ts","lineNumber":345,"sourceCode":"\n  const url = new URL(\"/auth/session\", req.url)\n  const response = (await Auth(\n    new Request(url, { headers: req.headers }),\n    options\n  )) as Response\n\n  const { status = 200 } = response\n\n  const data = await response.json()\n  const cookie = response.headers.get(\"set-cookie\")\n  if (!data || !Object.keys(data).length) {\n    return { data: null, cookie }\n  }\n  if (status === 200) {\n    return { data, cookie }\n  }\n\n  throw new Error(data.message)\n}\n\nexport const setEnvDefaults = (env: EnvGetter, config: AuthConfig) => {\n  if (!isServer) return\n  config.basePath = \"/auth\"\n  if (!config.secret?.length) {\n    config.secret = []\n    const secret = env.get(\"AUTH_SECRET\")\n    if (secret) {\n      config.secret.push(secret)\n    }\n    for (const i of [1, 2, 3]) {\n      const secret = env.get(`AUTH_SECRET_${i}`)\n      if (secret) {\n        config.secret.unshift(secret)\n      }\n    }\n  }","sourceCodeStart":327,"sourceCodeEnd":363,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/frameworks-qwik/src/index.ts#L327-L363","documentation":"The Qwik framework adapter's getSessionData parses the response from the Auth.js backend and throws Error(data.message) when the status is not 200. Like other framework adapters, it surfaces the backend's own 'message' field verbatim. Status 200 returns the data with cookie; an empty payload returns { data: null, cookie } instead of throwing.","triggerScenarios":"Invoking Qwik City's auth session loader / server$ call that hits /auth/session (or another auth action) while the backend returns a non-200 status — missing AUTH_SECRET, misconfigured basePath (Qwik sets basePath = \"/auth\" via setEnvDefaults), untrusted host, or an internal auth error.","commonSituations":"Qwik apps where auth route actions aren't mounted under /auth, so the fetch 404s; env vars not propagated to the Qwik server (EnvGetter misconfigured); calling session loaders during build/prerender when the auth server isn't reachable.","solutions":["Inspect the thrown data.message for the underlying Auth.js core error.","Confirm the auth API routes are mounted at basePath /auth in the Qwik server and reachable at runtime.","Provide AUTH_SECRET (and AUTH_TRUST_HOST where needed) through Qwik's env getter.","Avoid calling session-dependent loaders during prerender/SSG; make them dynamic."],"exampleFix":"// before\nconst { data } = await getSessionData(evt, overides) // throws on non-200\n// after\ntry {\n  const { data } = await getSessionData(evt, overides)\n} catch (e) {\n  console.error(\"Auth error:\", (e as Error).message)\n  return { data: null }\n}","handlingStrategy":"try-catch","validationCode":"if (!process.env.AUTH_SECRET) throw new Error(\"AUTH_SECRET missing\")\n// Confirm the Qwik auth endpoints are reachable under /auth before rendering session-dependent UI.\n","typeGuard":"function isSessionData(data: unknown): data is Record<string, unknown> {\n  return typeof data === \"object\" && data !== null\n}","tryCatchPattern":"try {\n  const { data } = await getSessionData(requestEvent, overides)\n} catch (err) {\n  console.error(\"Auth.js error (Qwik):\", (err as Error).message)\n  // fall back to anonymous session\n}","preventionTips":["Keep the auth routes mounted at the default basePath /auth.","Pass env vars through Qwik's EnvGetter, including AUTH_SECRET.","Avoid calling session loaders during prerender/SSG builds.","Test session fetches in the deployed environment, not only locally."],"tags":["qwik","session","http-response","framework-adapter"],"backgroundTag":"session-fetch-failed","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}