Skip to content

Astro.cookies.get() crashes with "URIError: URI malformed" if a cookie with an invalid value (e.g. 0:%) is manually set via DevTools in On-Demand Rendering (prerender=false) #14448

@Msaad022

Description

@Msaad022

Astro Info

Astro                    v5.13.2
Node                     v20.18.0
System                   Windows (x64)
Package Manager          npm
Output                   static
Adapter                  @astrojs/node
Integrations             astro:db
                         @astrojs/db/file-url

If this issue only occurs in one browser, which browser is a problem?

No response

Describe the Bug

When a cookie with an invalid value is manually added via the browser’s DevTools (for example 0:%), calling Astro.cookies.get("rolecheck") throws a URIError: URI malformed.

This specifically happens in On-Demand Rendering environments, when the page explicitly has:

export const prerender = false;

What's the expected result?

Astro should gracefully handle invalid or manually injected cookie values.
Instead of throwing a runtime error (URIError: URI malformed), the framework should:

Ignore the invalid cookie value, or

Return undefined from Astro.cookies.get("rolecheck")

This would prevent apps running in On-Demand Rendering mode (export const prerender = false) from crashing due to malformed cookies injected manually via DevTools.

Link to Minimal Reproducible Example

https://stackblitz.com/edit/github-p3yxrwqf?file=README.md

Participation

  • I am willing to submit a pull request for this issue.

Metadata

Metadata

Assignees

Labels

- P2: has workaroundAn edge case that only affects very specific usage, but has a trivial workaround (priority)

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions