Cookies set in middleware missing on server actions

[viniciusbitt]

Link to the code that reproduces this issue

https://github.com/viniciusbitt/nextjs-middleware-server-action-missing-cookie

To Reproduce

1. Clear cookies
2. Trigger server action
3. Set cookie in middleware
4. Try get the cookie on server action, but is undefined

Current vs. Expected behavior

I'm doing refresh token rotation in the middleware, and using server actions to validate if the user is logged in, I expected the cookie set on middleware to be visible to server actions

Provide environment information

Operating System:
  Platform: win32
  Arch: x64
  Version: Windows 11 Pro
  Available memory (MB): 32602
  Available CPU cores: 12
Binaries:
  Node: 20.12.2
  npm: N/A
  Yarn: N/A
  pnpm: N/A
Relevant Packages:
  next: 15.0.0-canary.68 // Latest available version is detected (15.0.0-canary.68).
  eslint-config-next: N/A
  react: 19.0.0-rc.0
  react-dom: 19.0.0-rc.0
  typescript: 5.3.3
Next.js Config:
  output: N/A

Which area(s) are affected? (Select all that apply)

Middleware

Which stage(s) are affected? (Select all that apply)

next dev (local), next build (local), next start (local)

Additional context

No response

[icyJoseph]

A bit tricky to see the issue in your example, because, straight up navigating to the landing page, sets a cookie too. That being said, I think something like this should work:

import { NextRequest, NextResponse } from "next/server";

export async function middleware(request: NextRequest) {
  const expires = new Date();
  expires.setMinutes(expires.getMinutes() + 60);

  const cookie = {
    httpOnly: true,
    name: "random_string",
    value: Math.random().toString(),
    expires,
  };

  request.cookies.set(cookie.name, cookie.value);

  let response = NextResponse.next({
    request: {
      headers: new Headers(request.headers),
    },
  });
  response.cookies.set(cookie);

  return response;
}

[viniciusbitt]

@icyJoseph It's kind of difficult to reproduce, you have to simulate the "access_token" (random_string) cookie expiring when calling server action, that's why I said to clear the cookies in the first step.

I tested your example and it worked, but is it the right way to do this? Looks like I'm back to the issue #49442

[icyJoseph]

I mean, I put it together from information present in the docs.

• https://nextjs.org/docs/app/building-your-application/routing/middleware#setting-headers

That link documents how to forward modified headers.

And that it is mentioned that you can set cookies on the incoming request:

For incoming requests, cookies comes with the following methods: get, getAll, set, and delete cookies. You can check for the existence of a cookie with has or remove all cookies with clear.

On the same page as the link above.

[Pbmangan]

I believe this issue is impacting supabase sever side auth on NextJS supabase/ssr#36

[cdgn-coding]

We are experiencing this issue in next 14.2.5 and below. Will this be merged to next 14? We cannot migrate to next 15.

[github-actions]

This closed issue has been automatically locked because it had no new activity for 2 weeks. If you are running into a similar issue, please create a new issue with the steps to reproduce. Thank you.