hasura/graphql-engine · error · Error

JWT Authorization token source: Cookie header not found

Error message

JWT Authorization token source: Cookie header not found

What it means

The JWT is configured to be extracted from a cookie, but the incoming request has no `Cookie` header at all.

Source

Thrown at v3/crates/auth/hasura-authn-jwt/src/jwt.rs:50

    KidHeaderNotFound,
    #[error("Expected the Hasura claims to be a String when `claimsFormat` is `stringifiedJson`")]
    ExpectedStringifiedJson,
    #[error("The default role is not present in the allowed roles")]
    DisallowedDefaultRole,
    #[error("The specified role is not present in the allowed roles")]
    DisallowedRole,
    #[error("Error while parsing the claims map entry: {claim_name} - {err}")]
    ParseClaimsMapEntryError {
        claim_name: String,
        err: serde_json::Error,
    },
    #[error("Expected string value for claim {claim_name}")]
    ClaimMustBeAString { claim_name: String },
    #[error("Required claim {claim_name} not found")]
    RequiredClaimNotFound { claim_name: String },
    #[error("JWT Authorization token source: Header name {header_name} not found.")]
    AuthorizationHeaderSourceNotFound { header_name: String },
    #[error("JWT Authorization token source: Cookie header not found")]
    CookieNotFound,
    #[error(
        "JWT Authorization token source: cookie name {cookie_name} not found in the Cookie header"
    )]
    CookieNameNotFound { cookie_name: String },
    #[error("Error in parsing the {header_name} header: {err}")]
    AuthorizationHeaderParseError { err: String, header_name: String },
    #[error("Error in parsing the Cookie header value: {err}")]
    CookieParseError { err: cookie::ParseError },
    #[error("Missing corresponding value for the cookie with cookie name: {cookie_name}")]
    MissingCookieValue { cookie_name: String },
    #[error("JWT validation error: {0}")]
    JWTValidationError(jwt::errors::Error),
    #[error("Internal Error - {0}")]
    Internal(#[from] InternalError),
}

impl TraceableError for Error {

View on GitHub (pinned to 724551b9ae)

Solutions

1. Have the client send the auth cookie with the request (fetch: credentials:'include'; axios: withCredentials:true)
2. Check browser devtools to confirm the cookie is set and sent
3. Verify cookie SameSite/Secure/Domain attributes allow cross-origin sending
4. For non-browser clients, attach the cookie header manually or switch auth mode to header-based

Example fix

// before
fetch(url)
// after
fetch(url, { credentials: 'include' })

if (!req.headers.get('cookie')) return unauthorized('no cookie header');

const hasCookieHeader = (h: Headers): boolean => h.get('cookie') !== null;

Return 401; optionally fall back to Authorization-header auth if configured.

When it happens

Trigger: Cookie-based JWT auth is enabled and the request contains no Cookie header — typical for plain API clients (curl, server-to-server) or cross-site requests where the browser drops cookies.

Common situations: Client not sending credentials (`credentials: 'include'` missing in fetch); SameSite/secure cookie policy blocking the cookie; testing with curl without a Cookie header; auth mode recently switched to cookie-based.

Related errors

• JWT Authorization token source: cookie name {cookie_name} no
• Error in parsing the Cookie header value: {err}
• Missing corresponding value for the cookie with cookie name:
• Session variable not found: {name}
• Error while parsing the claims map entry: {claim_name} - {er

AI-assisted analysis of hasura/graphql-engine@724551b9ae (2026-08-28). Data as JSON: /api/errors/8a4465f769e6984e. Report an issue: GitHub.