AdguardTeam/AdGuardHome · warning

decoding value: %w

Error message

decoding value: %w

What it means

The session cookie value is not valid hexadecimal, so it cannot be decoded into a session token. This points to a malformed, tampered, or truncated cookie rather than a stale one.

Source

Thrown at internal/home/authhttp.go:547

	}

	if s == nil {
		return nil, nil
	}

	u, err = mw.users.ByLogin(ctx, s.UserLogin)
	if err != nil {
		return nil, fmt.Errorf("searching user by login %q: %w", s.UserLogin, err)
	}

	return u, nil
}

// sessionTokenFromHex converts a hexadecimal string into a session token.
func sessionTokenFromHex(val string) (token aghuser.SessionToken, err error) {
	sess, err := hex.DecodeString(val)
	if err != nil {
		return token, fmt.Errorf("decoding value: %w", err)
	}

	l := aghuser.SessionTokenLength

	err = validate.Equal("token length", l, len(sess))
	if err != nil {
		// Don't wrap the error because it's informative enough as is.
		return token, err
	}

	return aghuser.SessionToken(sess), nil
}

// userFromRequestBasicAuth searches for a user using Basic Auth credentials.  r
// must not be nil.
func (mw *authMiddlewareDefault) userFromRequestBasicAuth(
	ctx context.Context,
	r *http.Request,

View on GitHub (pinned to b41aefbe51)

Solutions

1. Clear the browser cookies for the AdGuard Home host and log in again
2. Verify client code sends the exact cookie value previously issued (hex string of SessionTokenLength bytes)
3. Check that no intermediary rewrites or truncates Cookie headers

// Validate cookie is hex of expected length before sending
raw, err := hex.DecodeString(cookieValue)
if err != nil || len(raw) != 32 { /* discard cookie */ }

func isValidSessionCookie(v string) bool {
    b, err := hex.DecodeString(v)
    return err == nil && len(b) == 32
}

When it happens

Trigger: handleLogout or userFromCookie receiving a cookie whose value contains non-hex characters (e.g. edited by hand, wrong encoding, or garbage from another app on the same host/path).

Common situations: Manually crafted cookies, cookie corruption by a proxy, browsers storing overlapping cookie values, or client code sending the wrong cookie.

Related errors

• searching session by token: %w
• generating password hash: %w
• auth: blocked for %s
• auth: parsing remote address: %w
• searching user by login %q: %w

AI-assisted analysis of AdguardTeam/AdGuardHome@b41aefbe51 (2026-08-27). Data as JSON: /api/errors/eee8e0808b3ce1a9. Report an issue: GitHub.