nextauthjs / nextauthjs/next-auth
State cookie / PKCE code_verifier cookie missing
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 28.4k
- Forks
- 4k
- PR merge metrics
- No merged PRs in 30d
Description
Environment
System:
OS: macOS 15.3.2
CPU: (8) arm64 Apple M3
Memory: 109.34 MB / 16.00 GB
Shell: 5.9 - /bin/zsh
Binaries:
Node: 22.14.0 - ~/.nvm/versions/node/v22.14.0/bin/node
npm: 10.9.2 - ~/.nvm/versions/node/v22.14.0/bin/npm
Browsers:
Chrome: 134.0.6998.166
Safari: 18.3.1
npmPackages:
@auth/mongodb-adapter: ^3.7.4 => 3.8.0
next: ^14.2.20 => 14.2.25
next-auth: ^4.24.11 => 4.24.11
react: 18.2.0 => 18.2.0
Reproduction URL
https://github.com/LoickNosal/Cookie-Missing-NextAuth
Describe the issue
Hello, I'm having a problem with NextAuth.
I use two providers: Google and Apple.
I have one problem for each provider:
- For Google:
[next-auth][error][OAUTH_CALLBACK_ERROR]
State cookie was missing
providerId: 'google',
message: 'State cookie was missing.'
- For Apple:
[next-auth][error][OAUTH_CALLBACK_ERROR]
PKCE code_verifier cookie was missing.
providerId: 'apple',
message: 'PKCE code_verifier cookie was missing.'
These messages appear each time I log in to my application. It's not blocking, and users are able to log in. I'd like to understand the cause because I've already added a PKCE cookie to my next-auth.ts file.
This is polluting my environment's logs, and I'd like to fix it as soon as possible.
My next-auth.ts and next-auth.d.ts files in the link
Here are the versions used:
"next": "^14.2.20",
"next-auth": "^4.24.11",
"react": "18.2.0",
### How to reproduce
https://github.com/LoickNosal/Cookie-Missing-NextAuth
### Expected behavior
Shouldn't pollute my console with missing cookies errors.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked Cookie-Missing-NextAuth reproduction and inspect its next-auth.ts and next-auth.d.ts files. Reproduce the Google state-cookie and Apple PKCE code_verifier messages, then trace the relevant authentication flow; done means the reported login paths no longer emit missing-cookie errors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nextjs, react, typescript
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100