{"record":{"id":"f9db827a5feefff7","repo":"nextauthjs/next-auth","slug":"data-message-f9db82","errorCode":null,"errorMessage":"data.message","messagePattern":"data\\.message","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/frameworks-solid-start/src/index.ts","lineNumber":283,"sourceCode":"  req: Request,\n  options: Omit<AuthConfig, \"raw\">\n): GetSessionResult {\n  options.secret ??= process.env.AUTH_SECRET\n  options.trustHost ??= true\n\n  const url = new URL(\"/api/auth/session\", req.url)\n  const response = await Auth(\n    new Request(url, { headers: req.headers }),\n    options\n  )\n\n  const { status = 200 } = response\n\n  const data = await response.json()\n\n  if (!data || !Object.keys(data).length) return null\n  if (status === 200) return data\n  throw new Error(data.message)\n}\n","sourceCodeStart":265,"sourceCodeEnd":285,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/frameworks-solid-start/src/index.ts#L265-L285","documentation":"SolidStart's Auth.js adapter throws Error(data.message) when getSession receives a non-200 response from the auth backend. The 'message' field of the backend's JSON error payload becomes the thrown Error's message. A 200 with an empty object returns null, so this error only fires on real non-200 backend responses.","triggerScenarios":"Calling auth() / getSession inside a SolidStart server handler when the /auth/session endpoint returns non-200: missing AUTH_SECRET, basePath mismatch (SolidStart defaults to /auth), handler not mounted, or an Auth.js internal error (e.g. MissingSecret, UntrustedHost).","commonSituations":"SolidStart projects where the auth catch-all route ([...auth].ts) is missing or the dev/prod server environments differ; secrets present locally but absent in the deploy target; proxy setups causing host trust failures.","solutions":["Check the thrown message — it mirrors the Auth.js core error (e.g. MissingSecret, UntrustedHost).","Ensure the [...auth] catch-all route is present and exports the Auth.js request handlers.","Set AUTH_SECRET and, behind a proxy, AUTH_TRUST_HOST=true in the SolidStart runtime environment.","Curl /auth/session against your server to see the raw status and body."],"exampleFix":"// before\nconst authRequest = await auth(event) // throws Error(data.message)\n// after\nlet authRequest\ntry {\n  authRequest = await auth(event)\n} catch (e) {\n  console.error(\"Auth session error:\", (e as Error).message)\n  authRequest = null\n}","handlingStrategy":"try-catch","validationCode":"if (!process.env.AUTH_SECRET) throw new Error(\"AUTH_SECRET missing\")\n// Pre-flight: curl https://your-solidstart-app/auth/session and confirm HTTP 200.\n","typeGuard":"function isSession(data: unknown): data is Record<string, unknown> {\n  return typeof data === \"object\" && data !== null\n}","tryCatchPattern":"try {\n  const session = await auth(event)\n} catch (err) {\n  console.error(\"Auth.js error (SolidStart):\", (err as Error).message)\n  // treat request as unauthenticated\n}","preventionTips":["Keep the [...auth] catch-all route intact and exporting the handlers.","Set AUTH_SECRET and AUTH_TRUST_HOST=true behind proxies/load balancers.","Match basePath configuration with your actual route structure.","Add a deployment health check for the /auth/session endpoint."],"tags":["solid-start","session","http-response","framework-adapter"],"backgroundTag":"session-fetch-failed","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}