plandex-ai/plandex · error

error setting auth cookie: %v

Error message

error setting auth cookie: %v

What it means

ValidateAndSignIn fails when SetAuthCookieIfBrowser errors after successful credential validation. Cookie signing/serialization failed, so the session cannot be established for browser clients even though the user is authenticated.

Source

Thrown at app/server/handlers/auth_helpers.go:420

			if org.Id == signInCodeOrgId {
				filteredOrgs = append(filteredOrgs, org)
			}
		}
		orgs = filteredOrgs
	}

	// with a single org, set the orgId in the cookie
	// otherwise, the user will be prompted to select an org
	var orgId string
	if len(orgs) == 1 {
		orgId = orgs[0].Id
	}

	log.Println("Setting auth cookie if browser")
	err = SetAuthCookieIfBrowser(w, r, user, token, orgId)
	if err != nil {
		log.Printf("Error setting auth cookie: %v\n", err)
		return nil, fmt.Errorf("error setting auth cookie: %v", err)
	}

	apiOrgs, apiErr := toApiOrgs(orgs)

	if apiErr != nil {
		log.Printf("Error converting orgs to api orgs: %v\n", apiErr)
		return nil, fmt.Errorf("error converting orgs to api orgs: %v", apiErr)
	}

	resp := shared.SessionResponse{
		UserId:      user.Id,
		Token:       token,
		Email:       user.Email,
		UserName:    user.Name,
		Orgs:        apiOrgs,
		IsLocalMode: os.Getenv("GOENV") == "development" && os.Getenv("LOCAL_MODE") == "1",
	}

View on GitHub (pinned to e2d772072e)

Solutions

1. Inspect the wrapped %v cause from SetAuthCookieIfBrowser
2. Verify cookie store signing key configuration is present and consistent across replicas
3. Ensure HTTPS is used when secure cookies are required, or fix TLS termination at the proxy
4. Check cookie domain/path settings match the deployment host

Example fix

// before
err = SetAuthCookieIfBrowser(w, r, user, token, orgId)
if err != nil {
	return nil, fmt.Errorf("error setting auth cookie: %v", err)
}
// after
err = SetAuthCookieIfBrowser(w, r, user, token, orgId)
if err != nil {
	log.Printf("SetAuthCookieIfBrowser failed: %v", err)
	return nil, fmt.Errorf("error setting auth cookie: %v", err)
}

// verify cookie prerequisites before sign-in
if cookieStoreKey == nil {
	return errors.New("cookie store signing key not configured")
}

user, err := ValidateAndSignIn(w, r, req)
if err != nil {
	if strings.HasPrefix(err.Error(), "error setting auth cookie") {
		// token may still be valid — fall back to header-based auth
		http.Error(w, "session established but cookie failed; use bearer token", http.StatusInternalServerError)
		return
	}
	http.Error(w, err.Error(), http.StatusUnauthorized)
}

When it happens

Trigger: SignInHandler calls ValidateAndSignIn over a browser request; SetAuthCookieIfBrowser errors — e.g. no/invalid cookie store, secure-cookie/HTTPS mismatch, missing request context, or failure generating the cookie value.

Common situations: Cookie store key misconfigured or rotated; serving over plain HTTP while cookies require secure=true; behind a proxy that breaks TLS/headers; misconfigured cookie domain in multi-domain deployments.

Related errors

• error getting org session: %v
• error refreshing auth: auth not loaded
• auth.Current.UserId is empty
• no authenticated user
• no token

AI-assisted analysis of plandex-ai/plandex@e2d772072e (2026-09-05). Data as JSON: /api/errors/723ee1cf83371bc3. Report an issue: GitHub.