RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-user

error-invalid-user

Error message

Invalid user

What it means

Thrown by the 'resetAvatar' Meteor method wrapper when Meteor.userId() is null, i.e. the DDP call arrived without a valid login token. It is the standard 'you must be logged in' guard, fired before any permission or settings logic. Note the method itself is deprecated since 9.0.0 in favor of POST /v1/users.resetAvatar.

Source

Thrown at apps/meteor/server/meteor-methods/users/resetAvatar.ts:56

	} else {
		user = await Users.findOneById(fromUserId, { projection: { _id: 1, username: 1 } });
	}

	if (!user?.username) {
		throw new Meteor.Error('error-invalid-desired-user', 'Invalid desired user', {
			method: 'resetAvatar',
		});
	}

	await Upload.resetUserAvatar(user);
};

Meteor.methods<ServerMethods>({
	async resetAvatar(userId) {
		methodDeprecationLogger.method('resetAvatar', '9.0.0', '/v1/users.resetAvatar');
		const uid = Meteor.userId();
		if (!uid) {
			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
				method: 'resetAvatar',
			});
		}

		return resetAvatar(uid, userId);
	},
});

DDPRateLimiter.addRule(
	{
		type: 'method',
		name: 'resetAvatar',
		userId() {
			return true;
		},
	},
	1,
	60000,

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Ensure the user is authenticated before invoking: guard with Meteor.userId() and re-login if null.
  2. Handle 401-style method errors globally by redirecting to /login.
  3. Prefer the non-deprecated REST endpoint POST /v1/users.resetAvatar with X-Auth-Token/X-User-Id headers.

Example fix

// before
onClick={() => Meteor.callAsync('resetAvatar', uid)} // fails after token expiry

// after
onClick={async () => {
  if (!Meteor.userId()) return FlowRouter.go('/login');
  await Meteor.callAsync('resetAvatar', uid);
}}
Defensive patterns

Strategy: validation

Validate before calling

const uid = Meteor.userId();
if (!uid) {
  FlowRouter.go('/login');
} else {
  await Meteor.callAsync('resetAvatar', uid);
}

Try / catch

try {
  await Meteor.callAsync('resetAvatar', uid);
} catch (e) {
  if ((e as Meteor.Error).error === 'error-invalid-user') {
    handleSessionExpired(); // redirect to login and re-authenticate
  }
}

Prevention

When it happens

Trigger: Calling Meteor.call('resetAvatar', ...) after the login token expired or the user logged out; fire-and-forget calls from a component that outlived the session; scripts that connect DDP without authenticating first.

Common situations: Long-lived admin tabs whose token expired; logout triggered while a dialog action was still open; automated clients forgetting Meteor.loginWithPassword before invoking methods.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/502c45ce5c06e804. Report an issue: GitHub.