hasura/graphql-engine · error · Error

Missing corresponding value for the cookie with cookie name:

Error message

Missing corresponding value for the cookie with cookie name: {cookie_name}

What it means

A cookie with the configured name was found, but its value is empty/missing while extracting the JWT.

Source

Thrown at v3/crates/auth/hasura-authn-jwt/src/jwt.rs:60

        err: serde_json::Error,
    },
    #[error("Expected string value for claim {claim_name}")]
    ClaimMustBeAString { claim_name: String },
    #[error("Required claim {claim_name} not found")]
    RequiredClaimNotFound { claim_name: String },
    #[error("JWT Authorization token source: Header name {header_name} not found.")]
    AuthorizationHeaderSourceNotFound { header_name: String },
    #[error("JWT Authorization token source: Cookie header not found")]
    CookieNotFound,
    #[error(
        "JWT Authorization token source: cookie name {cookie_name} not found in the Cookie header"
    )]
    CookieNameNotFound { cookie_name: String },
    #[error("Error in parsing the {header_name} header: {err}")]
    AuthorizationHeaderParseError { err: String, header_name: String },
    #[error("Error in parsing the Cookie header value: {err}")]
    CookieParseError { err: cookie::ParseError },
    #[error("Missing corresponding value for the cookie with cookie name: {cookie_name}")]
    MissingCookieValue { cookie_name: String },
    #[error("JWT validation error: {0}")]
    JWTValidationError(jwt::errors::Error),
    #[error("Internal Error - {0}")]
    Internal(#[from] InternalError),
}

impl TraceableError for Error {
    fn visibility(&self) -> ErrorVisibility {
        // For the purpose of traces, all JWT errors should be developer facing.
        ErrorVisibility::User
    }
}

#[derive(Debug, thiserror::Error)]
pub enum InternalError {
    #[error("Error while constructing the JWT decoding key: {0}")]
    JWTDecodingKeyError(jwt::errors::Error),

View on GitHub (pinned to 724551b9ae)

Solutions

1. Check whether the client is setting the cookie with an empty value (devtools > Application > Cookies)
2. Fix client/server code that clears the cookie value on logout/expiry instead of deleting it
3. Treat an empty-value cookie as unauthenticated in your client flow instead of retrying

Example fix

// before: document.cookie = 'session=';
// after: document.cookie = 'session=; Max-Age=0'; // properly delete

const value = cookies[config.cookieName];
if (value === undefined || value === '') return unauthorized('empty auth cookie');

const hasNonEmptyCookie = (c: Record<string,string>, n: string): boolean => (c[n] ?? '') !== '';

Treat as unauthenticated (401) and clear/reissue the cookie on next login.

When it happens

Trigger: The auth cookie exists in the Cookie header but has no value (`name=` or `name`), so the JWT cannot be extracted.

Common situations: Logout flow or expired-session code that clears the cookie value but leaves the name; buggy client code setting an empty cookie; race during cookie refresh.

Related errors

• JWT Authorization token source: Cookie header not found
• JWT Authorization token source: cookie name {cookie_name} no
• Error in parsing the Cookie header value: {err}
• Session variable not found: {name}
• Error while parsing the claims map entry: {claim_name} - {er

AI-assisted analysis of hasura/graphql-engine@724551b9ae (2026-08-28). Data as JSON: /api/errors/d615f44ffbf2cac5. Report an issue: GitHub.