AlistGo/alist · error

empty captchaToken

Error message

empty captchaToken

What it means

ThunderX driver fails hard when the captcha-token endpoint returns 200 with an empty captchaToken and no verification Url. Without this token all subsequent signed browser API calls would be rejected, so the driver aborts with 'empty captchaToken'.

Source

Thrown at drivers/thunderx/util.go:179

	var resp CaptchaTokenResponse
	_, err := c.Request(XLUSER_API_URL+"/shield/captcha/init", http.MethodPost, func(req *resty.Request) {
		req.SetError(&e).SetBody(param)
	}, &resp)

	if err != nil {
		return err
	}

	if e.IsError() {
		return &e
	}

	if resp.Url != "" {
		return fmt.Errorf(`need verify: <a target="_blank" href="%s">Click Here</a>`, resp.Url)
	}

	if resp.CaptchaToken == "" {
		return fmt.Errorf("empty captchaToken")
	}

	if c.refreshCTokenCk != nil {
		c.refreshCTokenCk(resp.CaptchaToken)
	}
	c.SetCaptchaToken(resp.CaptchaToken)
	return nil
}

// Request 只有基础信息的请求
func (c *Common) Request(url, method string, callback base.ReqCallback, resp interface{}) ([]byte, error) {
	req := c.client.R().SetHeaders(map[string]string{
		"user-agent":       c.UserAgent,
		"accept":           "application/json;charset=UTF-8",
		"x-device-id":      c.DeviceID,
		"x-client-id":      c.ClientID,
		"x-client-version": c.ClientVersion,
	})

View on GitHub (pinned to 843d9dc814)

Solutions

  1. Retry after waiting, then re-login to refresh the whole session (not just the token).
  2. Confirm the account works on the official client and complete any pending verification there.
  3. Upgrade the OpenList/driver version if the captcha-token response parsing changed upstream.
Defensive patterns

Strategy: retry

Try / catch

if err != nil && strings.Contains(err.Error(), "empty captchaToken") {
    time.Sleep(5 * time.Second)
    err = retryLoginAndToken() // full re-login refreshes session + token
}

Prevention

When it happens

Trigger: The captcha token request in drivers/thunderx/util.go succeeds at the transport level, resp.Url is empty, and resp.CaptchaToken is empty — schema drift, soft rate-limit, or a dead/expired login session.

Common situations: Xunlei API updates changing the token field name, accounts flagged without a verification URL being offered, or hammering the endpoint after restart loops.

Related errors

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/d62f1bd64c925c96. Report an issue: GitHub.