nextauthjs/next-auth · error · Error

data.message

Error message

data.message

What it means

SolidStart's Auth.js adapter throws Error(data.message) when getSession receives a non-200 response from the auth backend. The 'message' field of the backend's JSON error payload becomes the thrown Error's message. A 200 with an empty object returns null, so this error only fires on real non-200 backend responses.

Source

Thrown at packages/frameworks-solid-start/src/index.ts:283

  req: Request,
  options: Omit<AuthConfig, "raw">
): GetSessionResult {
  options.secret ??= process.env.AUTH_SECRET
  options.trustHost ??= true

  const url = new URL("/api/auth/session", req.url)
  const response = await Auth(
    new Request(url, { headers: req.headers }),
    options
  )

  const { status = 200 } = response

  const data = await response.json()

  if (!data || !Object.keys(data).length) return null
  if (status === 200) return data
  throw new Error(data.message)
}

View on GitHub (pinned to a1a16a5a77)

Solutions

1. Check the thrown message — it mirrors the Auth.js core error (e.g. MissingSecret, UntrustedHost).
2. Ensure the [...auth] catch-all route is present and exports the Auth.js request handlers.
3. Set AUTH_SECRET and, behind a proxy, AUTH_TRUST_HOST=true in the SolidStart runtime environment.
4. Curl /auth/session against your server to see the raw status and body.

Example fix

// before
const authRequest = await auth(event) // throws Error(data.message)
// after
let authRequest
try {
  authRequest = await auth(event)
} catch (e) {
  console.error("Auth session error:", (e as Error).message)
  authRequest = null
}

if (!process.env.AUTH_SECRET) throw new Error("AUTH_SECRET missing")
// Pre-flight: curl https://your-solidstart-app/auth/session and confirm HTTP 200.

function isSession(data: unknown): data is Record<string, unknown> {
  return typeof data === "object" && data !== null
}

try {
  const session = await auth(event)
} catch (err) {
  console.error("Auth.js error (SolidStart):", (err as Error).message)
  // treat request as unauthenticated
}

When it happens

Trigger: Calling auth() / getSession inside a SolidStart server handler when the /auth/session endpoint returns non-200: missing AUTH_SECRET, basePath mismatch (SolidStart defaults to /auth), handler not mounted, or an Auth.js internal error (e.g. MissingSecret, UntrustedHost).

Common situations: SolidStart projects where the auth catch-all route ([...auth].ts) is missing or the dev/prod server environments differ; secrets present locally but absent in the deploy target; proxy setups causing host trust failures.

Related errors

• data.message
• data.message
• data.message
• Couldn't create session
• [createSession] Failed to fetch created session

AI-assisted analysis of nextauthjs/next-auth@a1a16a5a77 (2026-08-28). Data as JSON: /api/errors/f9db827a5feefff7. Report an issue: GitHub.