Cookies set in remote functions must have an absolute path

Error message

Cookies set in remote functions must have an absolute path

What it means

Remote function responses don't have a request URL context you can resolve relative cookie paths against, so any cookie `path` option passed from a remote function must be an absolute path starting with `/`. A relative or bare path makes the Set-Cookie header ambiguous, so SvelteKit throws.

Source

Thrown at packages/kit/src/runtime/app/server/remote/shared.js:97

 * @param {boolean} allow_cookies
 * @returns {RequestStore}
 */
function derive_remote_function_event(event, state, allow_cookies) {
	/** @type {RequestEvent} */
	const derived = {
		...event,
		setHeaders: () => {
			throw new Error('setHeaders is not allowed in remote functions');
		},
		cookies: {
			...event.cookies,
			set: (name, value, opts) => {
				if (!allow_cookies) {
					throw new Error('Cannot set cookies in `query` or `prerender` functions');
				}

				if (opts.path && !opts.path.startsWith('/')) {
					throw new Error('Cookies set in remote functions must have an absolute path');
				}

				return event.cookies.set(name, value, opts);
			},
			delete: (name, opts) => {
				if (!allow_cookies) {
					throw new Error('Cannot delete cookies in `query` or `prerender` functions');
				}

				if (opts.path && !opts.path.startsWith('/')) {
					throw new Error('Cookies deleted in remote functions must have an absolute path');
				}

				return event.cookies.delete(name, opts);
			}
		}
	};

View on GitHub (pinned to 03f1687fe6)

Solutions

Always pass an absolute path: `{ path: '/' }` for site-wide cookies.
Omit the `path` option entirely to use SvelteKit's default.
Prefix computed paths with '/' if they may be relative, or validate them before calling set().

Example fix

// before
event.cookies.set('session', token, { path: 'account' });
// after
event.cookies.set('session', token, { path: '/account' });

Defensive patterns

Strategy: validation

Validate before calling

function cookieOpts(opts = {}) {
  const path = opts.path ? (opts.path.startsWith('/') ? opts.path : '/' + opts.path) : undefined;
  return { ...opts, path };
}
event.cookies.set(name, value, cookieOpts(opts));

Type guard

function hasAbsolutePath(opts) { return !opts.path || opts.path.startsWith('/'); }

Try / catch

try {
  event.cookies.set(name, value, opts);
} catch (e) {
  if (e.message.includes('absolute path')) event.cookies.set(name, value, { ...opts, path: '/' });
  else throw e;
}

Prevention

Always use explicit absolute paths ('/') for cookies set in remote functions.
Normalize any dynamic path with a leading '/' before calling set/delete.
Prefer omitting `path` to inherit SvelteKit's default.

When it happens

Trigger: Calling `event.cookies.set(name, value, { path: 'sub' })` or `{ path: '' }` (falsy values skip the check; relative paths trigger it) inside any remote function's cookies.set/delete.

Common situations: Copy-pasting cookie code from middleware frameworks that allow relative paths; building the path from a variable that isn't rooted; assuming the default page path applies.

Related errors

AI-assisted analysis of sveltejs/kit@03f1687fe6 (2026-09-02). Data as JSON: /api/errors/7b2d0455976b84a6. Report an issue: GitHub.