nextauthjs/next-auth · error · InvalidCheck

${name} cookie was missing

Error message

${name} cookie was missing

What it means

parseCookie throws InvalidCheck with "<name> cookie was missing" when the OAuth state/PKCE/nonce cookie expected at the callback is absent. These cookies are set during sign-in and must round-trip through the provider; their absence means the CSRF/state check cannot be validated.

Source

Thrown at packages/core/src/lib/actions/callback/oauth/checks.ts:68

      value: payload,
      provider: options.provider.id,
    } satisfies CookiePayload,
    salt: cookie.name,
  })
  const cookieOptions = { ...cookie.options, expires }
  return { name: cookie.name, value: encoded, options: cookieOptions }
}

async function parseCookie(
  name: keyof CookiesOptions,
  value: string | undefined,
  options: InternalOptions
): Promise<string> {
  try {
    const { logger, cookies, jwt } = options
    logger.debug(`PARSE_${name.toUpperCase()}`, { cookie: value })

    if (!value) throw new InvalidCheck(`${name} cookie was missing`)
    const parsed = await decode<CookiePayload>({
      ...jwt,
      token: value,
      salt: cookies[name].name,
    })
    if (!parsed?.value) throw new Error("Invalid cookie")
    // The check must have been created by the provider currently handling
    // the callback.
    if (parsed.provider !== options.provider?.id) {
      throw new Error(
        `${name} cookie was created for a different provider than the one handling the callback`
      )
    }
    return parsed.value
  } catch (error) {
    throw new InvalidCheck(`${name} value could not be parsed`, {
      cause: error,
    })

View on GitHub (pinned to a1a16a5a77)

Solutions

1. Ensure AUTH_URL (or the configured redirect origin) matches the actual URL scheme/host so cookies aren't rejected as Secure.
2. Test in a normal browser window without privacy mode; verify cookies survive the provider redirect round trip.
3. Check any proxy/CDN isn't stripping Set-Cookie or Cookie headers; forward cookies correctly.
4. If behind HTTPS termination, set trustHost correctly and use AUTH_URL=https://... to keep Secure cookies valid.
5. Restart the sign-in flow from your app instead of reusing an old authorization URL bookmarked from a previous attempt.

const cb = new URL(callbackUrl)
const configured = new URL(process.env.AUTH_URL!)
if (cb.protocol !== configured.protocol || cb.host !== configured.host) {
  console.warn("Callback origin differs from AUTH_URL; cookies may be dropped")
}

function cookiePresent(req: Request, name: string): boolean {
  return req.headers.get("cookie")?.split(";").some(c => c.trim().startsWith(name + "=")) ?? false
}

try {
  await signIn("provider")
} catch (e) {
  if (e?.message?.includes("cookie was missing")) {
    // advise enabling cookies / restarting the sign-in flow
  }
}

When it happens

Trigger: Callback request arrives with no state (or pkce/nonce) cookie while the provider is configured with checks: ["state"] / ["pkce"]; cookies stripped by the browser or proxy; user opened the provider's login page in a different browser/profile than the one the cookie was set in.

Common situations: Cookie Secure/SameSite settings blocking cookies on http://localhost across ports; ITP/Safari partitioned cookies on cross-site redirects; reverse proxy not forwarding Set-Cookie/Cookie headers; AUTH_URL/redirect URI scheme mismatch (https callback served over http).

Related errors

• ${name} cookie was created for a different provider than the
• Invalid cookie
• ${name} value could not be parsed
• Invalid state
• State could not be decoded

AI-assisted analysis of nextauthjs/next-auth@a1a16a5a77 (2026-08-28). Data as JSON: /api/errors/ae3ffbcc5f7c69ae. Report an issue: GitHub.