RocketChat/Rocket.Chat · error · Meteor.Error

error-parameter-required

error-parameter-required

Error message

x-auth-token is required

What it means

Thrown by the logout-other-clients endpoint when the x-auth-token request header is missing or empty. The handler needs the raw token to hash it and keep the current session while invalidating the others.

Source

Thrown at apps/meteor/server/api/v1/users.ts:1644

			response: {
				200: ajv.compile<{ token: string; tokenExpires: string }>({
					type: 'object',
					properties: {
						token: { type: 'string' },
						tokenExpires: { type: 'string' },
						success: { type: 'boolean', enum: [true] },
					},
					required: ['token', 'tokenExpires', 'success'],
					additionalProperties: false,
				}),
				401: validateUnauthorizedErrorResponse,
			},
		},
		async function action() {
			const xAuthToken = this.request.headers.get('x-auth-token') as string;

			if (!xAuthToken) {
				throw new Meteor.Error('error-parameter-required', 'x-auth-token is required');
			}
			const hashedToken = Accounts._hashLoginToken(xAuthToken);

			if (!(await Users.removeNonPATLoginTokensExcept(this.userId, hashedToken))) {
				throw new Meteor.Error('error-invalid-user-id', 'Invalid user id');
			}

			const me = (await Users.findOneById(this.userId, { projection: { 'services.resume.loginTokens': 1 } })) as Pick<IUser, 'services'>;

			void notifyOnUserChange({
				clientAction: 'updated',
				id: this.userId,
				diff: { 'services.resume.loginTokens': me.services?.resume?.loginTokens },
			});

			const token = me.services?.resume?.loginTokens?.find((token) => token.hashedToken === hashedToken);

			const loginExp = settings.get<number>('Accounts_LoginExpiration');

View on GitHub (pinned to f9d3ec372b)

Solutions

  1. Include the x-auth-token: <login token> header on the request (alongside the normal X-Auth-Token / X-User-Id pair used by the REST API).
  2. Ensure no proxy/middleware strips custom headers.
  3. Confirm the SDK reads the token from storage and sets it on the request.

Example fix

// before
await POST('users.logoutOtherClients');

// after
await POST('users.logoutOtherClients', {}, { headers: { 'x-auth-token': loginToken } });
Defensive patterns

Strategy: validation

Validate before calling

if (!headers['x-auth-token']) { setError('x-auth-token header is required'); return; }
await POST('users.logoutOtherClients', {}, { headers });

Type guard

const hasAuthTokenHeader = (h: Record<string, string | undefined>): h is { 'x-auth-token': string } & Record<string, string | undefined> =>
  typeof h['x-auth-token'] === 'string' && h['x-auth-token'].length > 0;

Try / catch

null

Prevention

When it happens

Trigger: POST users.logoutOtherClients (or equivalent) without the x-auth-token header, or with an empty value.

Common situations: Client sent only the auth cookie / userId+token in the body but not the header; reverse proxy stripped the header; SDK misconfiguration.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/d4e7b4cb7e4c21fe. Report an issue: GitHub.