Cookie Error

[lorenz-reelist8]

🏷️ Discussion Type

Question

Body

The cookie is available in the backend as httpOnly, but when I try to access it in Next.js middleware, the token is undefined.

Here’s how I set the cookie in the backend:

• I generate a JWT token
• Then store it using res.cookie("token", token, { httpOnly: true, secure: ..., sameSite: "strict", path: "/" })

In my Next.js middleware, I try to access it like this:

const token = req.cookies.get("token")?.value;

But it returns undefined.

Why is the cookie not accessible in middleware even though it exists in the backend? What could be causing this issue?

Guidelines

• I have read and understood this category's guidelines before making this post.

[Uriah08]

This usually happens due to how cookies behave between the backend and Next.js middleware, not because your code is wrong.

Common causes:

1. Cookie not included in the request
   If your backend and frontend are on different domains or ports, the browser will NOT send cookies by default.

Fix:
Make sure your request includes credentials:

fetch("http://localhost:5000/api/...", {
credentials: "include"
});

Also enable CORS on your backend:

• Access-Control-Allow-Credentials: true

2. sameSite: "strict"
   You are using sameSite: "strict", which blocks cookies on cross-site requests.

Fix:
Use:
sameSite: "lax"
OR
sameSite: "none" (requires secure: true)

3. secure: true in development
   If secure is true, cookies only work on HTTPS.
   On localhost (HTTP), the cookie will NOT be sent.

Fix:
secure: process.env.NODE_ENV === "production"

4. Domain mismatch
   If backend is on:
   http://localhost:5000
   and frontend is on:
   http://localhost:3000

They are treated as different origins.

Fix:
Set cookie properly or proxy requests through Next.js API routes.

5. Middleware runs on the edge
   Next.js middleware runs before your request reaches API routes and only sees cookies that the browser actually sends.

If the cookie is not included in the request, middleware cannot read it.

Summary:
Your token is undefined because the cookie is not being sent to the middleware request. Most likely causes are:

• Missing credentials: "include"
• sameSite: "strict"
• secure: true on localhost
• Cross-origin setup

Recommended fix:

• Set sameSite: "lax"
• Use secure only in production
• Use credentials: "include" in fetch
• Ensure backend CORS allows credentials