Next.js Discord

Discord Forum

JWEDecryptionFailed: decryption operation failed\n

Answered
Naeemgg posted this in #help-forum
Open in Discord
NaeemggOP
[next-auth][error][JWT_SESSION_ERROR] 
https://next-auth.js.org/errors#jwt_session_error decryption operation failed {
  message: 'decryption operation failed',
  stack: 'JWEDecryptionFailed: decryption operation failed\n' +
    '    at gcmDecrypt (\.next\\server\\chunks\\6810.js:4034:15)\n' +
    '    at decrypt (\.next\\server\\chunks\\6810.js:4057:20)\n' +
    '    at flattenedDecrypt (\.next\\server\\chunks\\6810.js:778:52)\n' +
    '    at async compactDecrypt (\.next\\server\\chunks\\6810.js:588:23)\n' +
    '    at async jwtDecrypt (\.next\\server\\chunks\\6810.js:1987:23)\n' +
    '    at async Object.decode (\.next\\server\\chunks\\6810.js:9560:25)\n' +
    '    at async Object.session (\.next\\server\\chunks\\6810.js:9134:34)\n' +
    '    at async AuthHandler (\.next\\server\\chunks\\6810.js:6551:37)\n' +
    '    at async NextAuthRouteHandler (\.next\\server\\chunks\\6810.js:9667:30)\n' +
    '    at async NextAuth._args$ (\.next\\server\\chunks\\6810.js:9701:24)',
  name: 'JWEDecryptionFailed'
}

everything is good with yarn dev but with yarn build followed by yarn start, I'm getting these logs in my terminal.
Answered by joulev
it will look exactly like the session expired for those users
View full answer

21 Replies

NaeemggOP
you mean NEXTAUTH_SECRET?
joulev
yes
NaeemggOP
its same for both
joulev
either way, if you build for prod, then remove the cookie from your browser, then run next start and try to login, does the above error happen?
likely not
so your users won't see that error unless you change the secret for your prod deployment
this is generally a harmless error
even if your users do get this error they just need to login again
NaeemggOP
Ahh
let me clear cookies and browser cache and check it once again
what if I want to change the secret??
what is the optimal way?
joulev
changing the secret will just log out all users, so users need to login again
from the users' pov, there won't be any errors
NaeemggOP
Ohh got it
joulev
just that they are no longer automatically logged in and have to do it manually again
joulev
it will look exactly like the session expired for those users
Answer
NaeemggOP
yes you were right about clearing cookies
its not coming anymore
joulev
yeah, it's just the prod server cannot decode the cookie created by the dev server. likely due to different secrets used but idk enough about next-auth internals to say in more details