What causes "argument name is invalid: ${name}" in nextauthjs/next-auth?

Fix the cookie name to contain only valid token characters (ASCII letters, digits, and !#$%&'*+-.^_`|~).

nextauthjs/next-auth · error · TypeError

argument name is invalid: ${name}

Error message

argument name is invalid: ${name}

What it means

The vendored cookie `serialize` function validates the cookie name against cookieNameRegExp before writing the Set-Cookie header. Names must be valid HTTP header tokens (no separators, spaces, control chars, or non-ASCII). A TypeError is thrown immediately rather than emitting a malformed cookie.

Source

Thrown at packages/core/src/lib/vendored/cookie.ts:262

/**
 * Serialize data into a cookie header.
 *
 * Serialize a name value pair into a cookie string suitable for
 * http headers. An optional options object specifies cookie parameters.
 *
 * serialize('foo', 'bar', { httpOnly: true })
 *   => "foo=bar; httpOnly"
 */
export function serialize(
  name: string,
  val: string,
  options?: SerializeOptions
): string {
  const enc = options?.encode || encodeURIComponent

  if (!cookieNameRegExp.test(name)) {
    throw new TypeError(`argument name is invalid: ${name}`)
  }

  const value = enc(val)

  if (!cookieValueRegExp.test(value)) {
    throw new TypeError(`argument val is invalid: ${val}`)
  }

  let str = name + "=" + value
  if (!options) return str

  if (options.maxAge !== undefined) {
    if (!Number.isInteger(options.maxAge)) {
      throw new TypeError(`option maxAge is invalid: ${options.maxAge}`)
    }

    str += "; Max-Age=" + options.maxAge
  }

View on GitHub (pinned to a1a16a5a77)

Solutions

Fix the cookie name to contain only valid token characters (ASCII letters, digits, and !#$%&'*+-.^_`|~).
If a dynamic suffix is needed, encode or sanitize it first (e.g. encodeURIComponent the value used inside the name, or use a safe separator).
Validate/strip user-derived segments before using them as cookie names.
Check upstream callers to find where the bad name originates and reject it earlier.

Example fix

// before
res.setHeader("Set-Cookie", serialize(`session ${tenantId}`, token))
// after
const safeTenant = encodeURIComponent(tenantId)
res.setHeader("Set-Cookie", serialize(`session.${safeTenant}`, token))

Defensive patterns

Strategy: validation

Validate before calling

const COOKIE_NAME_RE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/
if (!COOKIE_NAME_RE.test(name)) throw new Error(`Refusing invalid cookie name: ${JSON.stringify(name)}`)

Type guard

function isValidCookieName(name: unknown): name is string {
  return typeof name === "string" && /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(name)
}

Try / catch

try {
  return serialize(name, value, opts)
} catch (e) {
  if (e instanceof TypeError && e.message.startsWith("argument name is invalid")) {
    return serialize(sanitizeCookieName(name), value, opts)
  }
  throw e
}

Prevention

Use only fixed, literal cookie names in application code
Sanitize/encode any dynamic segments before embedding them in cookie names
Reject or slugify user-derived input before it reaches cookie naming
Add a unit test asserting generated cookie names match the valid-token charset

When it happens

Trigger: Calling serialize(name, val, options) where `name` fails cookieNameRegExp — e.g. contains spaces, semicolons, equals signs, quotes, commas, or non-ASCII characters.

Common situations: Deriving a cookie name from user input or a dynamic key (tenant id, session prefix) that contains illegal characters; a typo like "session id" instead of "session.id"; framework-internal code passing an undefined/empty name after a refactor.

Related errors

AI-assisted analysis of nextauthjs/next-auth@a1a16a5a77 (2026-08-28). Data as JSON: /api/errors/2a72cf0b9fbd5550. Report an issue: GitHub.