Cannot delete cookies in `query` or `prerender` functions

Error message

Cannot delete cookies in `query` or `prerender` functions

What it means

Like `cookies.set`, deleting cookies writes to the response and is forbidden in read-only `query` and `prerender` remote functions. The derived event replaces `cookies.delete` with a guard that throws when cookie writes aren't allowed.

Source

Thrown at packages/kit/src/runtime/app/server/remote/shared.js:104

		setHeaders: () => {
			throw new Error('setHeaders is not allowed in remote functions');
		},
		cookies: {
			...event.cookies,
			set: (name, value, opts) => {
				if (!allow_cookies) {
					throw new Error('Cannot set cookies in `query` or `prerender` functions');
				}

				if (opts.path && !opts.path.startsWith('/')) {
					throw new Error('Cookies set in remote functions must have an absolute path');
				}

				return event.cookies.set(name, value, opts);
			},
			delete: (name, opts) => {
				if (!allow_cookies) {
					throw new Error('Cannot delete cookies in `query` or `prerender` functions');
				}

				if (opts.path && !opts.path.startsWith('/')) {
					throw new Error('Cookies deleted in remote functions must have an absolute path');
				}

				return event.cookies.delete(name, opts);
			}
		}
	};

	if (state.is_in_remote_query) {
		for (const property of ['url', 'params', 'route']) {
			// non-enumerable so spreading for a nested derivation doesn't invoke the getter
			Object.defineProperty(derived, property, {
				enumerable: false,
				get() {
					throw new Error(

View on GitHub (pinned to 03f1687fe6)

Solutions

Move the deletion into a `command` (or `form`) remote function and invoke it from the client.
Remove the cookie deletion if it's unnecessary in a read path.
Client-side, call `logoutCommand()` then refetch the query instead of clearing cookies during the query itself.

Example fix

// before
export const logout = query((event) => {
  event.cookies.delete('session', { path: '/' }); // throws
  return { ok: true };
});
// after
export const logout = command((event) => {
  event.cookies.delete('session', { path: '/' });
  return { ok: true };
});

Defensive patterns

Strategy: try-catch

Try / catch

try {
  event.cookies.delete('session', { path: '/' });
} catch (e) {
  if (e.message.includes('Cannot delete cookies')) {
    // defer to a command/form remote function
  } else throw e;
}

Prevention

Implement logout/cleanup as commands, not queries.
Keep query remote functions free of any cookie mutation.
Audit remote files for cookies.set/delete usage after refactors from load functions.

When it happens

Trigger: Calling `event.cookies.delete('session', { path: '/' })` inside a remote function declared with `.query(...)` or `.prerender(...)` — e.g. logging a user out within a query.

Common situations: Implementing logout/cleanup logic as a query because it 'doesn't return anything'; refactoring a `+page.server.js` load that cleared a cookie into a remote query.

Related errors

AI-assisted analysis of sveltejs/kit@03f1687fe6 (2026-09-02). Data as JSON: /api/errors/7a657cc663aab5ef. Report an issue: GitHub.