Looking at your code, I can spot the issue immediately — you have a typo in your cookie name.
When setting the cookie, you used:
context.cookies.set('userData', sessionData, { ... });
But when getting the cookie, you used:
context.cookies.get("user data")?.value;
"userData" ≠ "user data" — the space in the getter means it's looking for a completely different cookie, which doesn't exist, hence undefined.
Fix it to use the same name consistently:
context.cookies.set('userData', sessionData, {
httpOnly: true,
secure: true,
maxAge: 60 * 60 * 168
});
const getUserSession = context.cookies.get("userData")?.value;
Regarding the path option
If after fixing the typo you still have issues, note that when no path is specified, most clients default to the current domain root (/), which means the cookie should be accessible across all paths. [cookie set options]
If you explicitly set a path like /appengine/user, the cookie will only be sent by the browser for requests under that path. Since your action is likely called via a POST to /_actions/..., a restrictive path could prevent the cookie from being included in that request. Leaving path unset (or setting it to '/') is the safest approach for cross-path access.
Note: you can ask me a follow up question by @ mentioning me again :speech_balloon: