hasura/graphql-engine · error · Error

Error in parsing the Cookie header value: {err}

Error message

Error in parsing the Cookie header value: {err}

What it means

The Cookie header value failed to parse per the cookie crate's grammar ({err} is a cookie::ParseError). This means the header is syntactically invalid, not just missing a cookie.

Source

Thrown at v3/crates/auth/hasura-authn-jwt/src/jwt.rs:58

    ParseClaimsMapEntryError {
        claim_name: String,
        err: serde_json::Error,
    },
    #[error("Expected string value for claim {claim_name}")]
    ClaimMustBeAString { claim_name: String },
    #[error("Required claim {claim_name} not found")]
    RequiredClaimNotFound { claim_name: String },
    #[error("JWT Authorization token source: Header name {header_name} not found.")]
    AuthorizationHeaderSourceNotFound { header_name: String },
    #[error("JWT Authorization token source: Cookie header not found")]
    CookieNotFound,
    #[error(
        "JWT Authorization token source: cookie name {cookie_name} not found in the Cookie header"
    )]
    CookieNameNotFound { cookie_name: String },
    #[error("Error in parsing the {header_name} header: {err}")]
    AuthorizationHeaderParseError { err: String, header_name: String },
    #[error("Error in parsing the Cookie header value: {err}")]
    CookieParseError { err: cookie::ParseError },
    #[error("Missing corresponding value for the cookie with cookie name: {cookie_name}")]
    MissingCookieValue { cookie_name: String },
    #[error("JWT validation error: {0}")]
    JWTValidationError(jwt::errors::Error),
    #[error("Internal Error - {0}")]
    Internal(#[from] InternalError),
}

impl TraceableError for Error {
    fn visibility(&self) -> ErrorVisibility {
        // For the purpose of traces, all JWT errors should be developer facing.
        ErrorVisibility::User
    }
}

#[derive(Debug, thiserror::Error)]
pub enum InternalError {

View on GitHub (pinned to 724551b9ae)

Solutions

1. Inspect {err} for the specific parse failure position
2. Reproduce with a minimal Cookie header to isolate the offending cookie
3. Ensure cookie values are set with proper encoding (e.g. URL/base64) and no illegal characters
4. If a proxy rewrites cookies, bypass or fix its rewriting

Example fix

// before
Cookie: token="abc def"; other=1
// after
Cookie: token=abc%20def; other=1

try { parseCookieHeader(req.headers.get('cookie')); } catch (e) { return badRequest('invalid Cookie header'); }

Catch cookie::ParseError at the edge and reject with 400 before JWT processing; never retry the same header.

When it happens

Trigger: A Cookie header that violates cookie grammar, e.g. unencoded separators/quotes, illegal characters, or malformed name=value pairs.

Common situations: Manually constructed Cookie headers in tests/scripts with invalid characters; clients or proxies double-encoding or injecting invalid separators; very old/non-standard cookie values.

Related errors

• JWT Authorization token source: Cookie header not found
• JWT Authorization token source: cookie name {cookie_name} no
• Missing corresponding value for the cookie with cookie name:
• Session variable not found: {name}
• Error while parsing the claims map entry: {claim_name} - {er

AI-assisted analysis of hasura/graphql-engine@724551b9ae (2026-08-28). Data as JSON: /api/errors/37a6b9366e7fdb8f. Report an issue: GitHub.