getSessionToken :: failed to get session token, status code:

Error message

getSessionToken :: failed to get session token, status code: %d

What it means

getSessionToken got a non-200 HTTP status from MediaFire's get_session_token endpoint. Unlike the empty-token case (875), here the request failed at the HTTP layer: 403 from Cloudflare/bot protection when headers (secChUa, userAgent, Referer) don't match a real browser, 429 rate limiting, 5xx outages, or captive-portal responses from restricted networks.

Source

Thrown at drivers/mediafire/util.go:105

		cookieMap := make(map[string]string)
		for _, cookie := range resp.Cookies() {
			cookieMap[cookie.Name] = cookie.Value
		}

		if len(cookieMap) > 0 {

			var cookies []string
			for name, value := range cookieMap {
				cookies = append(cookies, fmt.Sprintf("%s=%s", name, value))
			}
			d.Cookie = strings.Join(cookies, "; ")
			op.MustSaveDriverStorage(d)

			//fmt.Printf("getSessionToken :: Captured cookies: %s\n", d.Cookie)
		}

	} else {
		return "", fmt.Errorf("getSessionToken :: failed to get session token, status code: %d", resp.StatusCode)
	}

	d.SessionToken = tokenResp.Response.SessionToken

	//fmt.Printf("Init :: Obtain Session Token %v", d.SessionToken)

	op.MustSaveDriverStorage(d)

	return d.SessionToken, nil
}

func (d *Mediafire) renewToken(_ context.Context) error {
	query := map[string]string{
		"session_token":   d.SessionToken,
		"response_format": "json",
	}

	var resp MediafireRenewTokenResponse

View on GitHub (pinned to 843d9dc814)

Solutions

Retry with backoff — 429/5xx are transient
Verify d.Addition userAgent/secChUa/secChUaPlatform match a real browser profile (these are sent verbatim)
Check the instance's egress IP isn't Cloudflare-blocked (test curl -A '<ua>' https://www.mediafire.com from the host)
Re-extract the cookie: an invalid cookie can also produce 403 rather than 200-with-error

Defensive patterns

Strategy: retry

Try / catch

Classify by status: 429/5xx -> retry with exponential backoff (respect Retry-After); 403 -> do not retry, log that the cookie/fingerprint (userAgent, secChUa headers) must be refreshed; other codes -> surface status code with the error.

Prevention

Fill userAgent, secChUa, secChUaPlatform in Addition to match a real browser
Avoid rapid re-Init loops that hammer the token endpoint
Run from residential or unblocked egress IPs; test with curl before blaming the code

When it happens

Trigger: Calling Init with a cookie rejected outright (403); rapid restarts hammering the endpoint (429); missing or default User-Agent / Sec-Ch-Ua fields (d.userAgent, d.secChUa empty in Addition); proxy or firewall intercepting mediafire.com.

Common situations: Instances restarted in a loop re-initializing storage; Datacenter IPs that Cloudflare flags; default config where browser-fingerprint headers were never filled in.

Related errors

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/0702d22c5968102b. Report an issue: GitHub.