RocketChat/Rocket.Chat · warning · Error
error-invalid-token
Error message
error-invalid-token
What it means
Thrown in the POST handler of 'livechat/messages' (message.ts:280-283) after the if/else block that either retrieves an existing visitor or registers a new one. const guest = visitor; if (!guest) throws. This is effectively dead code: in the 'if (visitor)' branch, visitor is guaranteed truthy; in the 'else' branch, registerGuest returning null already threw 'error-livechat-visitor-registration' at line 276. By line 280, visitor is always truthy.
Source
Thrown at apps/meteor/server/api/v1/omnichannel/message.ts:282
const guest: typeof this.bodyParams.visitor & { connectionData?: unknown } = this.bodyParams.visitor;
if (settings.get('Livechat_Allow_collect_and_store_HTTP_header_informations')) {
guest.connectionData = normalizeHttpHeaderData(this.request.headers);
}
visitor = await registerGuest(guest, {
shouldConsiderIdleAgent: settings.get<boolean>('Livechat_enabled_when_agent_idle'),
shouldConsiderOfflineAgent: settings.get<boolean>('Livechat_accept_chats_with_no_agents'),
});
if (!visitor) {
throw new Error('error-livechat-visitor-registration');
}
}
const guest = visitor;
if (!guest) {
throw new Error('error-invalid-token');
}
const sentMessages = await Promise.all(
this.bodyParams.messages.map(async (message: { msg: string }): Promise<{ username: string; msg: string; ts: number }> => {
const messageToSend = {
guest,
message: {
_id: Random.id(),
rid,
token: visitorToken,
msg: message.msg,
},
roomInfo: {
source: {
type: isWidget(this.request.headers) ? OmnichannelSourceType.WIDGET : OmnichannelSourceType.API,
},
},
};View on GitHub (pinned to f9d3ec372b)
Solutions
- Recognize this is unreachable — no runtime fix is needed. If encountered, investigate control-flow manipulation or monkey-patching of the visitor variable.
- Consider removing the redundant guard or renaming the error message to reflect its actual (impossible) condition.
Example fix
// before
const guest = visitor;
if (!guest) {
throw new Error('error-invalid-token');
}
// after — remove dead code; visitor is guaranteed non-null here
const guest = visitor;
// proceed directly to sendMessage logic Defensive patterns
Strategy: validation
Prevention
- No caller-side prevention needed — this code path is effectively unreachable because the prior code at lines 256-278 either keeps visitor truthy (existing visitor) or throws 'error-livechat-visitor-registration' (line 276).
- If maintaining this file, consider removing the redundant guard at lines 281-283 or renaming the misleading 'error-invalid-token' message.
When it happens
Trigger: Theoretically triggered if the visitor variable becomes falsy between the registration/retrieval block and line 280, which is not possible under normal synchronous control flow. The error message 'error-invalid-token' is misleading as it relates to visitor nullness, not token validity.
Common situations: Never encountered in practice. The check is a defensive guard that cannot fire because the prior code paths either keep visitor truthy (existing visitor) or throw early (registration failure at line 276).
Related errors
AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12).
Data as JSON: /api/errors/8a1e443360319dc5.
Report an issue: GitHub.