{"record":{"id":"c9167405d3ba5b42","repo":"appwrite/appwrite","slug":"user-jwt-and-cookie-set-c91674","errorCode":"user_jwt_and_cookie_set","errorMessage":"JWT and cookie used in the same request. Use either `setJWT` or `setCookie`. Learn about which authentication method to use in the SSR docs: https://appwrite.io/docs/products/auth/server-side-rendering","messagePattern":"JWT and cookie used in the same request\\. Use either `setJWT` or `setCookie`\\. Learn about which authentication method to use in the SSR docs: https://appwrite\\.io/docs/products/auth/server-side-rendering","errorType":"exception","errorClass":"Appwrite\\Extend\\Exception","httpStatus":403,"severity":"error","filePath":"app/init/resources/request.php","lineNumber":526,"sourceCode":"                        /** @var User $user */\n                        $user = $dbForProject->getDocument('users', $store->getProperty('id', ''));\n                    }\n                }\n            }\n        }\n\n        if (\n            ! $user ||\n            $user->isEmpty() // Check a document has been found in the DB\n            || ! $user->sessionVerify($store->getProperty('secret', ''), $proofForToken)\n        ) { // Validate user has valid login token\n            $user = new User([]);\n        }\n\n        $authJWT = $request->getHeaderLine('x-appwrite-jwt', '');\n        if (! empty($authJWT) && ! $project->isEmpty()) { // JWT authentication\n            if (! $user->isEmpty()) {\n                throw new Exception(Exception::USER_JWT_AND_COOKIE_SET);\n            }\n\n            $jwt = new JWT(System::getEnv('_APP_OPENSSL_KEY_V1'), 'HS256', 3600, 0);\n            try {\n                $payload = $jwt->decode($authJWT);\n            } catch (JWTException $error) {\n                throw new Exception(Exception::USER_JWT_INVALID, 'Failed to verify JWT. ' . $error->getMessage());\n            }\n\n            $jwtUserId = $payload['userId'] ?? '';\n            if (! empty($jwtUserId)) {\n                if ($mode === APP_MODE_ADMIN) {\n                    /** @var User $user */\n                    $user = $dbForPlatform->getDocument('users', $jwtUserId);\n                } else {\n                    /** @var User $user */\n                    $user = $dbForProject->getDocument('users', $jwtUserId);\n                }","sourceCodeStart":508,"sourceCodeEnd":544,"githubUrl":"https://github.com/appwrite/appwrite/blob/cd368e707d4b492bc5e8e9c0f8ecbc5b741c4bf4/app/init/resources/request.php#L508-L544","documentation":"The HTTP-request counterpart of error 301. Thrown in app/init/resources/request.php:526 when an inbound HTTP request resolves a non-empty user from the session cookie/store AND also carries an x-appwrite-jwt header. Appwrite disallows mixing session and JWT credentials in one HTTP request; the SSR docs are referenced for choosing one method.","triggerScenarios":"An HTTP API call (any /v1 endpoint) that has a valid session resolving to a user (via sessionVerify on the store secret/proof token) AND also sets x-appwrite-jwt. The !$user->isEmpty() guard trips before JWT decode.","commonSituations":"SSR framework holding a session cookie while the server-side fetch also attaches a JWT; SDK configured with both setSession and setJWT; cookie not cleared on logout before issuing a JWT-authenticated call; reverse proxy injecting cookies.","solutions":["For each HTTP call use EITHER setSession (cookie) OR setJWT, never both.","Clear the session cookie before making JWT-authenticated server-side calls.","In SSR, segregate client-side (cookie) and server-side (JWT) SDK instances so headers never combine.","Inspect outbound request headers to confirm a single credential type."],"exampleFix":"// before — SSR fetch sends both\nclient.setSession(sessionCookie);\nclient.setJWT(jwt);\n// after — server-side call uses JWT only\nclient.setJWT(jwt);","handlingStrategy":"validation","validationCode":"// Before each SSR HTTP call, ensure session and JWT are mutually exclusive\nfunction assertSingleAuth(sessionCookie: string | null, jwt: string | null) {\n  if (sessionCookie && jwt) {\n    throw new Error('Do not send session and JWT together; choose one.');\n  }\n}","typeGuard":null,"tryCatchPattern":"// Recover by dropping the cookie and retrying with JWT\ntry {\n  await databases.listDocuments();\n} catch (e) {\n  if (e.code === 'user_jwt_and_cookie_set') {\n    client.headers['Cookie'] = '';\n    await databases.listDocuments();\n  } else throw e;\n}","preventionTips":["Maintain separate SDK instances for SSR (JWT) and browser (cookie).","Clear session cookies on logout before issuing JWT calls.","Inspect request headers in dev to confirm a single auth method."],"tags":["authentication","jwt","session","ssr","http"],"backgroundTag":null,"analyzedSha":"cd368e707d4b492bc5e8e9c0f8ecbc5b741c4bf4","analyzedAt":"2026-08-12T14:42:48.571Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}