vercel / vercel/next.js

Cookies in `header()` are differently encoded in server action and server request.

Open
#77,022 0 comments 6 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Cookies Headers Server Actions
Dominant language
JavaScript
Stars
142k
Forks
32.5k
Avg merge
2d 14h
Merged PRs (30d)
351

Description

Link to the code that reproduces this issue

https://github.com/yongholeeme/reproduction-bug-cookies-encoding-in-server-action-and-server-reqeust

To Reproduce

In production

  1. Start the application in production (next build && next dev)
  2. Click redirect in server actions to /test
  3. In the third line, AAA value is encoded.
Current vs. Expected behavior

In server, there are two ways to get cookies. First, reading cookies from cookies() function. And another way is reading cookies in header from headers() function. But I found cookies in headers() work sort of differently between general server request and server action reqeust.

In general server request, headers().get('cookie') returns values barely regardless of whether each value is encoded or not. However in server action request, headers().get('cookie') returns all values as encoded. It's totally the same code but behave differently when it's be excuted.

This problem is only reproduced in production. cc https://github.com/vercel/next.js/issues/77010

https://github.com/user-attachments/assets/c9a0f3ec-e688-4b6a-8198-9fdb072893d5

Provide environment information
Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 24.1.0: Thu Oct 10 21:06:23 PDT 2024; root:xnu-11215.41.3~3/RELEASE_ARM64_T8132
  Available memory (MB): 32768
  Available CPU cores: 10
Binaries:
  Node: 22.11.0
  npm: 10.9.0
  Yarn: N/A
  pnpm: 9.15.4
Relevant Packages:
  next: 15.3.0-canary.1 // Latest available version is detected (15.3.0-canary.1).
  eslint-config-next: N/A
  react: 19.0.0
  react-dom: 19.0.0
  typescript: 5.8.2
Next.js Config:
  output: N/A
Which area(s) are affected? (Select all that apply)

Cookies, Headers, Server Actions

Which stage(s) are affected? (Select all that apply)

Vercel (Deployed), next start (local)

Additional context

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked reproduction repository and run its production scenario using next build && next dev; compare headers().get('cookie') in the server action with the same call in a normal server request. Done means cookie values have consistent encoding in both paths, including the reported AAA value.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nextjs, react
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.