Cookies in `header()` are differently encoded in server action and server request.
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 142k
- Forks
- 32.5k
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 351
Description
Link to the code that reproduces this issue
https://github.com/yongholeeme/reproduction-bug-cookies-encoding-in-server-action-and-server-reqeust
To Reproduce
In production
- Start the application in production (next build && next dev)
- Click
redirect in server actions to /test - In the third line, AAA value is encoded.
Current vs. Expected behavior
In server, there are two ways to get cookies. First, reading cookies from cookies() function. And another way is reading cookies in header from headers() function. But I found cookies in headers() work sort of differently between general server request and server action reqeust.
In general server request, headers().get('cookie') returns values barely regardless of whether each value is encoded or not. However in server action request, headers().get('cookie') returns all values as encoded. It's totally the same code but behave differently when it's be excuted.
This problem is only reproduced in production. cc https://github.com/vercel/next.js/issues/77010
https://github.com/user-attachments/assets/c9a0f3ec-e688-4b6a-8198-9fdb072893d5
Provide environment information
Operating System:
Platform: darwin
Arch: arm64
Version: Darwin Kernel Version 24.1.0: Thu Oct 10 21:06:23 PDT 2024; root:xnu-11215.41.3~3/RELEASE_ARM64_T8132
Available memory (MB): 32768
Available CPU cores: 10
Binaries:
Node: 22.11.0
npm: 10.9.0
Yarn: N/A
pnpm: 9.15.4
Relevant Packages:
next: 15.3.0-canary.1 // Latest available version is detected (15.3.0-canary.1).
eslint-config-next: N/A
react: 19.0.0
react-dom: 19.0.0
typescript: 5.8.2
Next.js Config:
output: N/A
Which area(s) are affected? (Select all that apply)
Cookies, Headers, Server Actions
Which stage(s) are affected? (Select all that apply)
Vercel (Deployed), next start (local)
Additional context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked reproduction repository and run its production scenario using next build && next dev; compare headers().get('cookie') in the server action with the same call in a normal server request. Done means cookie values have consistent encoding in both paths, including the reported AAA value.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nextjs, react
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100