hasura/graphql-engine · error · Error

JWT Authorization token source: cookie name {cookie_name} no

Error message

JWT Authorization token source: cookie name {cookie_name} not found in the Cookie header

What it means

A Cookie header was present, but the specific cookie configured as the JWT source (`{cookie_name}`) is not among the parsed cookies.

Source

Thrown at v3/crates/auth/hasura-authn-jwt/src/jwt.rs:52

    ExpectedStringifiedJson,
    #[error("The default role is not present in the allowed roles")]
    DisallowedDefaultRole,
    #[error("The specified role is not present in the allowed roles")]
    DisallowedRole,
    #[error("Error while parsing the claims map entry: {claim_name} - {err}")]
    ParseClaimsMapEntryError {
        claim_name: String,
        err: serde_json::Error,
    },
    #[error("Expected string value for claim {claim_name}")]
    ClaimMustBeAString { claim_name: String },
    #[error("Required claim {claim_name} not found")]
    RequiredClaimNotFound { claim_name: String },
    #[error("JWT Authorization token source: Header name {header_name} not found.")]
    AuthorizationHeaderSourceNotFound { header_name: String },
    #[error("JWT Authorization token source: Cookie header not found")]
    CookieNotFound,
    #[error(
        "JWT Authorization token source: cookie name {cookie_name} not found in the Cookie header"
    )]
    CookieNameNotFound { cookie_name: String },
    #[error("Error in parsing the {header_name} header: {err}")]
    AuthorizationHeaderParseError { err: String, header_name: String },
    #[error("Error in parsing the Cookie header value: {err}")]
    CookieParseError { err: cookie::ParseError },
    #[error("Missing corresponding value for the cookie with cookie name: {cookie_name}")]
    MissingCookieValue { cookie_name: String },
    #[error("JWT validation error: {0}")]
    JWTValidationError(jwt::errors::Error),
    #[error("Internal Error - {0}")]
    Internal(#[from] InternalError),
}

impl TraceableError for Error {
    fn visibility(&self) -> ErrorVisibility {
        // For the purpose of traces, all JWT errors should be developer facing.

View on GitHub (pinned to 724551b9ae)

Solutions

1. Compare the configured {cookie_name} with the cookie name actually set by your auth server
2. Log the incoming Cookie header to see what the client sent
3. Check cookie expiry, Domain and Path attributes on the set-cookie response
4. Align the cookie name across auth server and JWT configuration

Example fix

// before: JWT config cookie name: "session"; auth server sets "__Host-session"
// after: use the identical name in both configs

const cookies = parseCookies(req.headers.get('cookie') ?? '');
if (!(config.cookieName in cookies)) return unauthorized(`cookie ${config.cookieName} missing`);

const hasCookie = (c: Record<string,string>, n: string): boolean => n in c && c[n] !== '';

Return 401 naming the expected cookie; direct the user to re-authenticate to set it.

When it happens

Trigger: Cookie auth mode with cookie name (e.g. `__Host-authorization-token`), request has other cookies but not the configured one — cookie expired, renamed, or never set.

Common situations: Cookie name mismatch between auth-server config and JWT config; cookie expired or was cleared; cookie set on a different domain/path so the client never echoes it back.

Related errors

• JWT Authorization token source: Cookie header not found
• Error in parsing the Cookie header value: {err}
• Missing corresponding value for the cookie with cookie name:
• Session variable not found: {name}
• Error while parsing the claims map entry: {claim_name} - {er

AI-assisted analysis of hasura/graphql-engine@724551b9ae (2026-08-28). Data as JSON: /api/errors/863d3da62802a4c2. Report an issue: GitHub.