SillyTavern/SillyTavern · error

Forbidden

Error message

Forbidden

What it means

Returned as HTTP 403 by GET /api/users/me when request.user is falsy (users-private.js:37). The route relies on an authentication middleware that populates request.user; if no middleware authenticated the caller, request.user is undefined and the endpoint refuses to return profile data. This is the standard 'not authenticated' response for the /me endpoint.

Source

Thrown at src/endpoints/users-private.js:38

            console.error('Session not available');
            return response.sendStatus(500);
        }

        request.session.handle = null;
        request.session.csrfToken = null;
        request.session.version = null;
        request.session = null;
        return response.sendStatus(204);
    } catch (error) {
        console.error(error);
        return response.sendStatus(500);
    }
});

router.get('/me', async (request, response) => {
    try {
        if (!request.user) {
            return response.sendStatus(403);
        }

        const user = request.user.profile;
        const viewModel = {
            handle: user.handle,
            name: user.name,
            avatar: await getUserAvatar(user.handle),
            admin: user.admin,
            password: !!user.password,
            created: user.created,
        };

        return response.json(viewModel);
    } catch (error) {
        console.error(error);
        return response.sendStatus(500);
    }
});

View on GitHub (pinned to 8172dcd0ee)

Solutions

1. Ensure the caller is logged in and sends the session cookie.
2. Confirm the authentication middleware is mounted before the users-private router for GET routes too.
3. On 403, redirect the user to the login page rather than retrying blindly.

Example fix

// before — calling /me with no credentials
fetch('/api/users/me')
// after
if (!hasSessionCookie()) { location.href = '/login'; return; }
fetch('/api/users/me', { credentials: 'same-origin' })

// only call /me when we expect to be authenticated
async function getMe() {
  const res = await fetch('/api/users/me', { credentials:'same-origin' });
  if (res.status === 403) { location.href = '/login'; return null; }
  return res.json();
}

When it happens

Trigger: Calling GET /api/users/me without a valid session cookie; the auth middleware did not run or did not set request.user; the session expired between page load and the /me fetch.

Common situations: Cookie expired or was cleared; auth middleware misconfigured or skipped for this route in tests; a proxy rewrote the path so the request bypassed the auth middleware; CSRF or session version mismatch caused the auth middleware to leave request.user unset.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Unauthorized
• Forbidden: No permission to install global extensions.
• Forbidden: No permission to update global extensions.
• Forbidden: No permission to list branches of global extensio
• Internal server error.

AI-assisted analysis of SillyTavern/SillyTavern@8172dcd0ee (2026-08-13). Data as JSON: /api/errors/b6199ca9f888c306. Report an issue: GitHub.