What this usually means
This usually means the initial HTTP request to the Nuxt server (Node or serverless) is missing the Cookie header, or that cookies are not being forwarded through a proxy/load balancer. Alternatively, you may be trying to use client-only cookie methods during SSR, or the cookie library isn't reading the header correctly.
The first ten minutes — establish facts before touching code.
- 1Add a console.log(JSON.stringify(req.headers)) at the top of serverMiddleware/index.js to check if cookies are present in headers.
- 2Use curl -I 'https://your-app.com' -H 'Cookie: test=1' and verify if your middleware logs show the test cookie.
- 3On the server, inspect incoming headers using tcpdump: sudo tcpdump -A -i any port 443 | grep -i cookie
- 4Double-check NGINX/Cloudflare/ELB config for proxy_set_header Cookie $http_cookie;
- 5Temporarily hardcode a set-cookie header in serverMiddleware and see if the browser receives it in SSR responses.
- 6Use req.cookies vs. req.headers.cookie depending on library (cookieparser, cookie-universal-nuxt, etc.)
The specific files, logs, configs, and dashboards that usually own this bug.
- searchserverMiddleware/index.js and any custom API endpoints in /api/
- searchnuxt.config.js for serverMiddleware and SSR config
- searchauth module config (e.g., @nuxtjs/auth, @nuxt/auth-next)
- searchReverse proxy configs: NGINX, Apache, AWS ALB rules
- searchBrowser DevTools Network tab (check requests to your SSR entrypoint for Cookie headers)
- searchAny custom server (express/fastify) setup wrapping Nuxt
Practical causes, not theory. These are the things you will actually find.
- warningProxy not forwarding Cookie header (common with NGINX and Cloudflare default configs)
- warningUsing window or document.cookie in SSR context instead of req.headers.cookie
- warningForgetting to register cookie-parser or universal-cookie module in Nuxt serverMiddleware
- warningCookie flagged as HttpOnly and then attempting to read it client-side only
- warningWrong path/domain attributes on set-cookie (cookie not sent on SSR request path)
- warningMixing SPA and SSR modes, causing store/state hydration mismatch
Concrete fix directions. Pick the one that matches your root cause.
- buildExplicitly forward Cookie headers in all proxy layers (e.g., proxy_set_header Cookie $http_cookie; in NGINX)
- buildSwitch all SSR cookie reads to rely on req.headers.cookie or context.app.$cookies from universal-cookie module
- buildIf using serverMiddleware, always parse cookies with cookieparser: app.use(cookieParser());
- buildUpdate nuxt.config.js to ensure serverMiddleware runs before any SSR-rendered route
- buildFor session cookies, set SameSite=Lax and check Path/Domain matches SSR entrypoint
- buildIn nuxtServerInit, always check if process.server && !!context.req before reading cookies
A fix you cannot prove is a guess. Close the loop.
- verifiedLog headers in serverMiddleware and verify cookies arrive on every SSR-rendered request
- verifiedSSR-rendered pages reflect logged-in state or session from cookie (not just after hydration)
- verifiedTest logins from incognito and ensure SSR state initializes from cookies every time
- verifiedBrowser DevTools shows Set-Cookie and Cookie headers present in both requests and responses
- verifiedReload SSR page, inspect store, and confirm it matches expected cookie-derived state
- verifiedWrite an integration test using supertest to check cookie handoff in /api and SSR
Things that make this bug worse or harder to find.
- warningDo not rely on client-side cookie libraries (like js-cookie) for SSR logic
- warningNever assume cookies are always present; always check for undefined in SSR context
- warningDon’t trust that your cloud proxy is forwarding all headers unless you verify (esp. Cloudflare, AWS ALB)
- warningAvoid reading cookies in asyncData/fetch without confirming process.server and context.req
- warningDon’t mix SPA mode and SSR mode configuration in the same Nuxt deployment
- warningNever set cookies with mismatched Domain, Path, or SameSite attributes
SSR Session Loss Behind NGINX Proxy
Timeline
- 14:00Production deploy completes; users report being logged out after page reload.
- 14:07Initial triage: SSR store shows user null, but client-side hydration restores session.
- 14:12Console.log of req.headers reveals missing cookie field server-side.
- 14:18Checked NGINX config; proxy_set_header Cookie $http_cookie; line is absent.
- 14:22Added correct proxy_set_header, redeployed NGINX container.
- 14:25SSR now receives cookies; user session correctly restored on initial SSR request.
After a Friday update, users suddenly reported being logged out each time an SSR-rendered page loaded, but were magically logged back in a second later. I suspected a session mismatch, so I dumped req.headers in the Nuxt serverMiddleware and saw that cookies were not present at all in SSR requests.
Digging into our Dockerized NGINX config, I realized I had omitted the proxy_set_header Cookie $http_cookie; line after tweaking some upstream rules. This meant every SSR request from the browser lost its session context before it even hit Node.
Adding the header back and redeploying NGINX instantly fixed the issue—the store was now hydrated properly on the server and SSR pages resumed showing the correct, logged-in state from the outset.
Root cause
NGINX proxy was not forwarding incoming Cookie headers to the Nuxt server, so all SSR requests arrived without session data.
The fix
Restored proxy_set_header Cookie $http_cookie; in the NGINX config and redeployed.
The lesson
Never push proxy changes to production without confirming all original headers are preserved—SSR depends on them for session state.
A classic symptom: SSR-rendered pages show a logged-out state, but after hydration, the client shows logged-in—because the client can access cookies via document.cookie, but the server saw nothing due to missing headers.
If your store or page state is correct only after hydration, suspect cookies missing in SSR. The solution is always at the HTTP transport/proxy layer, not in your Vuex or store logic.
Frequently asked questions
Why do cookies work on the client but not during SSR in Nuxt?
Because client-side code reads window.document.cookie, but SSR only receives cookies if the incoming HTTP request has a Cookie header. If the header is missing (proxy misconfig, etc.), SSR won’t see any cookies.
How do I ensure NGINX forwards cookies to my Nuxt server?
Add proxy_set_header Cookie $http_cookie; to your NGINX location block. Reload NGINX. Without this, no cookies are sent upstream regardless of browser state.
What’s the best practice for reading cookies in Nuxt SSR?
Use context.req.headers.cookie (raw string) or context.app.$cookies.get(), via cookie-universal-nuxt, only when process.server is true. Never use window or js-cookie in SSR context.
Why does nuxtServerInit not initialize the store from cookies?
This happens if the SSR request is missing cookies due to misrouted headers, or if nuxtServerInit doesn’t check for process.server/context.req before accessing cookies.
How can I debug SSR cookies end-to-end?
Log req.headers in middleware, inspect HTTP requests in your browser’s Network tab, and use curl with custom Cookie headers to simulate requests. Always check every proxy layer.