What causes "empty session token received" in AlistGo/alist?

Re-open mediafire.com in the browser, confirm you are logged in, and re-extract both Cookie and session token

empty session token received

Error message

empty session token received

What it means

getSessionToken received HTTP 200 from /application/get_session_token.php, parsed the JSON successfully, but response.session_token was empty/absent. MediaFire returns 200 with an error payload (result: 'Error') when the supplied Cookie header is invalid, expired, or from a logged-out session — the scraper-style auth handshake depends entirely on that cookie.

Source

Thrown at drivers/mediafire/util.go:84

		return "", err
	}

	//fmt.Printf("getSessionToken :: Raw response: %s\n", string(body))
	//fmt.Printf("getSessionToken :: Parsed response: %+v\n", resp)

	var tokenResp struct {
		Response struct {
			SessionToken string `json:"session_token"`
		} `json:"response"`
	}

	if resp.StatusCode == 200 {
		if err := json.Unmarshal(body, &tokenResp); err != nil {
			return "", err
		}

		if tokenResp.Response.SessionToken == "" {
			return "", fmt.Errorf("empty session token received")
		}

		cookieMap := make(map[string]string)
		for _, cookie := range resp.Cookies() {
			cookieMap[cookie.Name] = cookie.Value
		}

		if len(cookieMap) > 0 {

			var cookies []string
			for name, value := range cookieMap {
				cookies = append(cookies, fmt.Sprintf("%s=%s", name, value))
			}
			d.Cookie = strings.Join(cookies, "; ")
			op.MustSaveDriverStorage(d)

			//fmt.Printf("getSessionToken :: Captured cookies: %s\n", d.Cookie)
		}

View on GitHub (pinned to 843d9dc814)

Solutions

Re-open mediafire.com in the browser, confirm you are logged in, and re-extract both Cookie and session token
Check that the Cookie string is complete (all name=value pairs, no truncation)
If it persists, capture the raw response body (the commented-out Printf in the source) to see the API's error message and verify MediaFire's response format hasn't changed
Treat this error as a signal to re-do the full credential setup, not to retry

Defensive patterns

Strategy: validation

Validate before calling

func plausibleCookie(c string) bool {
    return strings.TrimSpace(c) != "" && strings.Contains(c, "=") && strings.Contains(c, "xmf")
}

Try / catch

Treat this as a fatal credential error: log it, mark the storage as needing re-configuration, and do not retry in a loop — an empty token means the cookie was rejected and only fresh cookie extraction fixes it.

Prevention

Re-extract cookie and session token together from one logged-in browser session
Log the raw response body on this failure to see MediaFire's error message
Alert on repeated token-acquisition failures rather than silently continuing

When it happens

Trigger: Calling Init or the token-renew cron with a stale Cookie; cookie captured from a browser session that has since logged out; MediaFire changing its response shape so the session_token key moves or is renamed.

Common situations: Tokens/cookies older than MediaFire's session lifetime; copying the cookie of a different account than the session token; Cloudflare interstitials returning HTML-ish JSON that unmarshals but contains no token.

Related errors

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/32f968ac94bb9ada. Report an issue: GitHub.