Cookies can only be modified in a Server Action or Route Handler

[padupuy]

Hi @rwieruch !

I was reading your blog post and wondering when this code will be executed ?
I thought that it was forbidden to update the cookies during the rendering phase.
This code can raise the famous error :

Cookies can only be modified in a Server Action or Route Handler. Read more: https://nextjs.org/docs/app/api-reference/functions/cookies#cookiessetname-value-options

next-authentication/src/features/auth/queries/get-auth.ts

Lines 22 to 41 in 8346197

	try {
	if (result.session && result.session.fresh) {
	const sessionCookie = lucia.createSessionCookie(
	result.session.id
	);
	cookies().set(
	sessionCookie.name,
	sessionCookie.value,
	sessionCookie.attributes
	);
	}
	if (!result.session) {
	const sessionCookie = lucia.createBlankSessionCookie();
	cookies().set(
	sessionCookie.name,
	sessionCookie.value,
	sessionCookie.attributes
	);
	}
	} catch {}

thank you for all your articles, they are great resources 🫶

[rwieruch]

Hi @padupuy good point. I had the same question and you'll find the answer over here: lucia-auth/lucia#1540 (comment) I hope this helps!

[padupuy]

Maybe a better way to handle the refresh token flow would be to use the middleware to check the validity of the session ?
If the session is expired, try to renew it :

• If it succeeded, set the new cookies
• If it failed, logout the user.

I'm also closely following the status of the Next.js RFC "Request Interceptors" vercel/next.js#70961