nextauthjs/next-auth · error · TypeError

option path is invalid: ${options.path}

Error message

option path is invalid: ${options.path}

What it means

serialize() validates the optional `path` option against pathValueRegExp before appending `; Path=`. If the value contains characters not permitted in a cookie path attribute (per RFC 6265 path-value grammar), a TypeError is thrown. This prevents emitting a Set-Cookie header the browser would reject or misinterpret.

Source

Thrown at packages/core/src/lib/vendored/cookie.ts:292

  if (options.maxAge !== undefined) {
    if (!Number.isInteger(options.maxAge)) {
      throw new TypeError(`option maxAge is invalid: ${options.maxAge}`)
    }

    str += "; Max-Age=" + options.maxAge
  }

  if (options.domain) {
    if (!domainValueRegExp.test(options.domain)) {
      throw new TypeError(`option domain is invalid: ${options.domain}`)
    }

    str += "; Domain=" + options.domain
  }

  if (options.path) {
    if (!pathValueRegExp.test(options.path)) {
      throw new TypeError(`option path is invalid: ${options.path}`)
    }

    str += "; Path=" + options.path
  }

  if (options.expires) {
    if (
      !isDate(options.expires) ||
      !Number.isFinite(options.expires.valueOf())
    ) {
      throw new TypeError(`option expires is invalid: ${options.expires}`)
    }

    str += "; Expires=" + options.expires.toUTCString()
  }

  if (options.httpOnly) {
    str += "; HttpOnly"

View on GitHub (pinned to a1a16a5a77)

Solutions

1. Pass a plain path string starting with '/', typically path: '/'
2. Trim the configured value and encode or strip illegal characters before passing it
3. Use new URL(base).pathname to extract just the path portion of a URL
4. Validate against a path-value regex before calling serialize

Example fix

// before
serialize('sid', val, { path: process.env.BASE_PATH }) // ' /app '
// after
serialize('sid', val, { path: (process.env.BASE_PATH || '/').trim() })

function isValidCookiePath(p) {
  return typeof p === 'string' && p.length > 0 && !/[;\s",\\]/.test(p)
}
if (opts.path && !isValidCookiePath(opts.path)) throw new TypeError(`option path is invalid: ${opts.path}`)

function isCookiePath(v: unknown): v is string {
  return typeof v === 'string' && v.startsWith('/') && !/[;\s",\\]/.test(v)
}

let cookie
try {
  cookie = serialize('sid', val, { path })
} catch (err) {
  if (err instanceof TypeError && err.message.startsWith('option path is invalid')) {
    throw new ConfigError(`Bad cookie path '${path}' — must be a plain path like '/app'`)
  }
  throw err
}

When it happens

Trigger: Calling serialize(name, val, { path: '/app; Path=/' }) or any path containing forbidden characters such as spaces, semicolons, quotes, control characters, or a full URL instead of a path.

Common situations: Building the path from user input or route segments without encoding; accidentally passing a full URL ('https://example.com/app'); template-string mistakes that inject extra attributes into the path value; trailing whitespace from config files.

Related errors

• option domain is invalid: ${options.domain}
• option expires is invalid: ${options.expires}
• option priority is invalid: ${options.priority}
• option sameSite is invalid: ${options.sameSite}
• argument name is invalid: ${name}

AI-assisted analysis of nextauthjs/next-auth@a1a16a5a77 (2026-08-28). Data as JSON: /api/errors/42062fddb37f15b8. Report an issue: GitHub.