AlistGo/alist · error

empty captchaToken

Error message

empty captchaToken

What it means

Thrown by the thunder_browser driver when the captcha-token endpoint returns HTTP 200 with neither a Url nor a captchaToken field. The driver treats an empty captchaToken as a hard failure because every subsequent browser-API request must carry this token.

Source

Thrown at drivers/thunder_browser/util.go:175

	var resp CaptchaTokenResponse
	_, err := c.Request(XLUSER_API_URL+"/shield/captcha/init", http.MethodPost, func(req *resty.Request) {
		req.SetError(&e).SetBody(param)
	}, &resp)

	if err != nil {
		return err
	}

	if e.IsError() {
		return &e
	}

	if resp.Url != "" {
		return fmt.Errorf(`need verify: <a target="_blank" href="%s">Click Here</a>`, resp.Url)
	}

	if resp.CaptchaToken == "" {
		return fmt.Errorf("empty captchaToken")
	}

	if c.refreshCTokenCk != nil {
		c.refreshCTokenCk(resp.CaptchaToken)
	}
	c.SetCaptchaToken(resp.CaptchaToken)
	return nil
}

// Request 只有基础信息的请求
func (c *Common) Request(url, method string, callback base.ReqCallback, resp interface{}) ([]byte, error) {
	req := c.client.R().SetHeaders(map[string]string{
		"user-agent":       c.UserAgent,
		"accept":           "application/json;charset=UTF-8",
		"x-device-id":      c.DeviceID,
		"x-client-id":      c.ClientID,
		"x-client-version": c.ClientVersion,
	})

View on GitHub (pinned to 843d9dc814)

Solutions

1. Retry the login after a short wait — transient empty responses happen during rate limiting.
2. Verify account status by logging into the official Thunder web client; clear verification there if prompted.
3. Update OpenList/the driver to the latest version in case the captcha-token endpoint or payload changed.
4. Check the raw response logging (enable debug) to confirm whether the endpoint moved or the JSON shape changed.

var err error
for attempt := 0; attempt < 3; attempt++ {
    err = c.getCaptchaToken(...)
    if err == nil || !strings.Contains(err.Error(), "empty captchaToken") { break }
    time.Sleep(time.Duration(attempt+1) * 2 * time.Second)
}

When it happens

Trigger: The captcha token request completes without transport error and without resp.Url, but resp.CaptchaToken == "" — e.g. API changed response schema, rate-limited/soft-blocked account returning an empty 200, or login session invalidated server-side.

Common situations: Upstream Thunder API contract changes after an app update, account in a flagged state that neither issues a token nor a verification URL, or interim server responses during maintenance.

Related errors

• need verify: <a target="_blank" href="%s">Click Here</a>
• empty captchaToken
• resolutions is required
• <div style="font-family: Arial, sans-serif; padding: 15px;
• need verify: <a target="_blank" href="%s">Click Here</a>

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/7a54fb80aeecf738. Report an issue: GitHub.