Cookies deleted in remote functions must have an absolute pa

Error message

Cookies deleted in remote functions must have an absolute path

What it means

Remote functions (`query`, `form`, `command`, `prerender`) allow deleting cookies through the derived event, but the options passed to `cookies.delete` must specify an absolute path (starting with `/`). SvelteKit throws this because a relative path would be ambiguous across remote function invocations. Supply `path: '/'` (or another absolute path) when deleting.

Source

Thrown at packages/kit/src/runtime/app/server/remote/shared.js:108

			...event.cookies,
			set: (name, value, opts) => {
				if (!allow_cookies) {
					throw new Error('Cannot set cookies in `query` or `prerender` functions');
				}

				if (opts.path && !opts.path.startsWith('/')) {
					throw new Error('Cookies set in remote functions must have an absolute path');
				}

				return event.cookies.set(name, value, opts);
			},
			delete: (name, opts) => {
				if (!allow_cookies) {
					throw new Error('Cannot delete cookies in `query` or `prerender` functions');
				}

				if (opts.path && !opts.path.startsWith('/')) {
					throw new Error('Cookies deleted in remote functions must have an absolute path');
				}

				return event.cookies.delete(name, opts);
			}
		}
	};

	if (state.is_in_remote_query) {
		for (const property of ['url', 'params', 'route']) {
			// non-enumerable so spreading for a nested derivation doesn't invoke the getter
			Object.defineProperty(derived, property, {
				enumerable: false,
				get() {
					throw new Error(
						`Cannot access event.${property} in a query. Pass the value as an argument to the query instead`
					);
				}
			});

View on GitHub (pinned to 03f1687fe6)

Solutions

Change the delete options to use an absolute path, e.g. `{ path: '/' }` or `{ path: '/admin' }`
If the cookie was set with a specific path, delete it with exactly that absolute path
If you don't need path scoping, omit nothing and pass `{ path: '/' }` explicitly

Example fix

// before
event.cookies.delete('session', { path: 'account' });
// after
event.cookies.delete('session', { path: '/account' });

Defensive patterns

Strategy: validation

Validate before calling

function assertAbsolutePath(opts = {}) {
  if (opts.path && !opts.path.startsWith('/')) {
    throw new TypeError(`cookie path must be absolute, got: ${opts.path}`);
  }
}
// call before event.cookies.delete(name, opts)

Type guard

const hasAbsolutePath = (opts) => !opts?.path || opts.path.startsWith('/');

Try / catch

try {
  event.cookies.delete(name, opts);
} catch (e) {
  if (e.message.includes('absolute path')) {
    event.cookies.delete(name, { ...opts, path: '/' });
  } else throw e;
}

Prevention

Always pass an explicit absolute path when deleting cookies in remote functions
Use the same constant for a cookie's set and delete path
Add a lint rule or helper wrapper that rejects relative cookie paths

When it happens

Trigger: Calling `event.cookies.delete('name', { path: 'sub' })` or any opts.path not beginning with '/' inside a remote `query`/`form`/`command` function (with allow_cookies enabled).

Common situations: Copy-pasting cookie deletion code from a `load` function into a remote function; assuming the default relative-path semantics of other cookie APIs; deleting a cookie scoped to a subpath like 'admin' instead of '/admin'.

Related errors

AI-assisted analysis of sveltejs/kit@03f1687fe6 (2026-09-02). Data as JSON: /api/errors/27e3072db74169e8. Report an issue: GitHub.