Argument of type 'ReadonlyRequestCookies' is not assignable to parameter of type 'CookieStore'

[barziahmed]

Hello,

Next.js version: 15.0.0-canary.134
iron-session version: 8.0.3

cookies() in the getIronSession parameter, has the following TS error:

Argument of type 'ReadonlyRequestCookies' is not assignable to parameter of type 'CookieStore'.
  Types of property 'set' are incompatible.
    Type '(...args: [key: string, value: string, cookie?: Partial<ResponseCookie>] | [options: ResponseCookie]) => ResponseCookies' is not assignable to type '{ (name: string, value: string, cookie?: Partial<ResponseCookie> | undefined): void; (options: ResponseCookie): void; }'.
      Types of parameters 'args' and 'name' are incompatible.
        Type '[name: string, value: string, cookie?: Partial<ResponseCookie> | undefined]' is not assignable to type '[key: string, value: string, cookie?: Partial<ResponseCookie>] | [options: ResponseCookie]'.
          Type '[name: string, value: string, cookie?: Partial<ResponseCookie> | undefined]' is not assignable to type '[key: string, value: string, cookie?: Partial<ResponseCookie>]'.
            Type at position 2 in source is not compatible with type at position 2 in target.
              Type 'Partial<ResponseCookie> | undefined' is not assignable to type 'Partial<ResponseCookie>'.
                Type 'undefined' is not assignable to type 'Partial<ResponseCookie>'.ts(2345)
(alias) cookies(): ReadonlyRequestCookies
import cookies

This is my code:

'use server'

import { type SessionOptions, getIronSession } from 'iron-session'
import { cookies } from 'next/headers'
import { SESSION_SECRET_KEY } from '@/constants'

export interface SessionData {
    username: string
    isLoggedIn: boolean
    counter: number
}

const sessionOptions: SessionOptions = {
    password: SESSION_SECRET_KEY,
    cookieName: 'session',
    cookieOptions: {
        secure: process.env.NODE_ENV === 'production',
    },
}

export const getServerActionSession = async () => {
    const session = await getIronSession<SessionData>(cookies(), sessionOptions)
    return session
}

export default getServerActionSession

[fitimbytyqi]

+1

[dsmikeyorke]

@Barzi-Ahmed we are dealing with this same error. Do you by any chance have react-email installed as well? When we remove this package we no longer see the error but the second we install react-email the error comes back.

[barziahmed]

@dsmikeyorke , no I don't have react-email, and still have the issue. But look, I find that iron-session is not very necessary, as next.js already has a lot of cookie features and its own cookies api, so why use this third party library? I would only make use of sealData and unsealdata functionality, but even for these two I can easily implement my own using web crypto api...

[fitimbytyqi]

@Barzi-Ahmed How would you encrypt and decrypt the user's data coming after login from an external api and set that in a cookie ?

Could you show some code using web crypto api ?

[coronapl]

This is similar to #690. Installing @types/cookie fixes the problem.

[TomiwaPhilip]

@Barzi-Ahmed we are dealing with this same error. Do you by any chance have react-email installed as well? When we remove this package we no longer see the error but the second we install react-email the error comes back.

I also have react-email installed but this resolved it

  const cookiesStore: any = cookies();
  
  const session = await getIronSession<SessionData>(cookiesStore, sessionOptions);

Although not really advisable to type it as any, but this is a temporary fix

[dasveloper]

@Barzi-Ahmed we are dealing with this same error. Do you by any chance have react-email installed as well? When we remove this package we no longer see the error but the second we install react-email the error comes back.

I also have react-email installed but this resolved it

  const cookiesStore: any = cookies();
  
  const session = await getIronSession<SessionData>(cookiesStore, sessionOptions);

Although not really advisable to type it as any, but this is a temporary fix

I was able to get it to work without the any by just awaiting the cookies()

const cookieStore = await cookies();
const session = await getIronSession<SessionData>(cookieStore, sessionOptions);

[jimmyhoran]

@Barzi-Ahmed we are dealing with this same error. Do you by any chance have react-email installed as well? When we remove this package we no longer see the error but the second we install react-email the error comes back.

I also have react-email installed but this resolved it

  const cookiesStore: any = cookies();
  
  const session = await getIronSession<SessionData>(cookiesStore, sessionOptions);

Although not really advisable to type it as any, but this is a temporary fix

I was able to get it to work without the any by just awaiting the cookies()

const cookieStore = await cookies();
const session = await getIronSession<SessionData>(cookieStore, sessionOptions);

@dasveloper is that with or without @types/cookie installed? Only because cookies() is of a non-Promise value - so not sure how you got that to work 🤔

[s1hagog]

installing @types/cookie is unnecessary. This issue only happens in Next.js v15^ and can be fixed 3 different (4 if use any) ways

1. Use UnsafeWrappedCookies type assertion. That is if you want to keep sync logic, the downisde is that this type will disappear in Next 16

import { SessionData, sessionOptions } from '../../lib/session';
import { getIronSession } from 'iron-session';
import { cookies, UnsafeUnwrappedCookies } from 'next/headers';

const session = await getIronSession<SessionData>(
    cookies() as unknown as UnsafeUnwrappedCookies,
    sessionOptions,
); 

2. Add await (most likely the best)

import { SessionData, sessionOptions } from '../../lib/session';
import { getIronSession } from 'iron-session';
import { cookies } from 'next/headers';

 const session = await getIronSession<SessionData>(
    await cookies(),
    sessionOptions,
 );

3. Use use from react

import { SessionData, sessionOptions } from '../../lib/session';
import { getIronSession } from 'iron-session';
import { cookies } from 'next/headers';
import { use } from 'react';

const session = await getIronSession<SessionData>(
    use(cookies()),
    sessionOptions,
);

4. use any (not recommended)

import { SessionData, sessionOptions } from '../../lib/session';
import { getIronSession } from 'iron-session';
import { cookies } from 'next/headers';

 const session = await getIronSession<SessionData>(
    cookies() as any, 
    sessionOptions,
 );

This happens because of this change in Nextjs 15
node_modules/next/dist/server/request/cookies.d.ts

In this version of Next.js cookies() returns a Promise however you can still reference the properties of the underlying cookies object...

All the approaches I suggested are from the official Next docs (ref: docs

[ChrisCates]

Monitoring the issue: @s1hagog, neither solution 1 or 2 worked. This issue should be bumped.
IronSession should add support for "exactOptionalPropertyTypes": true.

For the time being, using any.