Cannot set cookies in `query` or `prerender` functions

Error message

Cannot set cookies in `query` or `prerender` functions

What it means

Cookies are a write operation on the HTTP response, and `query`/`prerender` remote functions are conceptually read-only/cached, so their derived event rejects `cookies.set`. Only `command` and `form` remote functions (those with `allow_cookies`) may set cookies.

Source

Thrown at packages/kit/src/runtime/app/server/remote/shared.js:93

/**
 * @param {RequestEvent} event
 * @param {RequestState} state
 * @param {boolean} allow_cookies
 * @returns {RequestStore}
 */
function derive_remote_function_event(event, state, allow_cookies) {
	/** @type {RequestEvent} */
	const derived = {
		...event,
		setHeaders: () => {
			throw new Error('setHeaders is not allowed in remote functions');
		},
		cookies: {
			...event.cookies,
			set: (name, value, opts) => {
				if (!allow_cookies) {
					throw new Error('Cannot set cookies in `query` or `prerender` functions');
				}

				if (opts.path && !opts.path.startsWith('/')) {
					throw new Error('Cookies set in remote functions must have an absolute path');
				}

				return event.cookies.set(name, value, opts);
			},
			delete: (name, opts) => {
				if (!allow_cookies) {
					throw new Error('Cannot delete cookies in `query` or `prerender` functions');
				}

				if (opts.path && !opts.path.startsWith('/')) {
					throw new Error('Cookies deleted in remote functions must have an absolute path');
				}

				return event.cookies.delete(name, opts);

View on GitHub (pinned to 03f1687fe6)

Solutions

Move the cookie write into a `command` or `form` remote function and call that from the client before/after the query.
Remove the cookie mutation if the data can be kept client-side instead.
Pass the would-be cookie value as an argument to the query and persist it via a command.

Example fix

// before
export const prefs = query((event) => {
  event.cookies.set('theme', 'dark', { path: '/' }); // throws
  return getPrefs();
});
// after
export const setTheme = command((event, theme) => {
  event.cookies.set('theme', theme, { path: '/' });
});

Defensive patterns

Strategy: try-catch

Try / catch

try {
  event.cookies.set('theme', value, { path: '/' });
} catch (e) {
  if (e.message.includes('Cannot set cookies')) {
    // fall back to a command() call or client-side storage
  } else throw e;
}

Prevention

Treat queries/prerender functions as strictly read-only.
Do all cookie writes in command/form remote functions.
Persist user preferences via commands, then read them back in queries.

When it happens

Trigger: Calling `event.cookies.set(...)` inside a remote function declared with `.query(...)` or `.prerender(...)`, e.g. storing a preference during a read.

Common situations: Recording 'recently viewed' items or locale prefs inside a query; migrating code from `+page.server.js` actions into queries without realizing write restrictions differ.

Related errors

AI-assisted analysis of sveltejs/kit@03f1687fe6 (2026-09-02). Data as JSON: /api/errors/a58b4be7341f06a4. Report an issue: GitHub.