TechnitiumSoftware/DnsServer · error · InvalidTokenWebServiceException

Invalid token or session expired.

Error message

Invalid token or session expired.

What it means

InvalidTokenWebServiceException thrown in WebServiceApiMiddleware when a Primary-node-only API is requested on a Secondary cluster node and TryValidateSession fails. The session must be validated before the request is proxied to the Primary node; an invalid/expired token (or none) results in this error instead of a blind proxy.

Source

Thrown at DnsServerCore/DnsWebService.cs:2351

        }

        private async Task WebServiceApiMiddleware(HttpContext context, RequestDelegate next)
        {
            HttpRequest request = context.Request;

            if (_clusterManager.ClusterInitialized)
            {
                ClusterNodeType pathNodeType = GetClusterNodeTypeForPath(request.Path);
                switch (pathNodeType)
                {
                    case ClusterNodeType.Primary:
                        //this api can be called only on primary node
                        ClusterNode selfNode = _clusterManager.GetSelfNode();
                        if (selfNode.Type == ClusterNodeType.Secondary)
                        {
                            //validate user session before proxying request
                            if (!TryValidateSession(context, out UserSession session))
                                throw new InvalidTokenWebServiceException("Invalid token or session expired.");

                            //proxy to primary node
                            ClusterNode primaryNode = _clusterManager.GetPrimaryNode();
                            await primaryNode.ProxyRequest(context, session.User.Username);
                            return;
                        }

                        break;

                    case ClusterNodeType.Secondary:
                        //this api must be called on current node
                        break;

                    default:
                        //this api can be called on any specified node
                        string nodeName = request.GetQueryOrForm("node", null);
                        if (!string.IsNullOrEmpty(nodeName) && (nodeName != "cluster"))
                        {

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Re-authenticate via /api/user/login or /api/user/createToken to obtain a fresh token, then retry.
2. Ensure the client sends the token in the header the server expects (Authorization) on every primary-only call.
3. Direct primary-only calls at the Primary node, or keep the cluster topology so the proxy path validates.
4. Confirm the user account is not disabled in auth.config.

Example fix

null

// Ensure a non-expired token exists before calling primary-only APIs
if (!await IsSessionAliveAsync())
    await LoginAsync();

null

catch (InvalidTokenWebServiceException)
{
    await LoginAsync(); // refresh token
    await RetryPrimaryCallAsync(); // then retry once
}

When it happens

Trigger: In a cluster, a client calls an API classified ClusterNodeType.Primary while connected to a Secondary node, with a missing, malformed, disabled-user, or expired session token. TryValidateSession returns false (null session, disabled user, or expired).

Common situations: Token expired between UI open and the call; user was disabled; SSO session lapsed; load balancer routed the client to a secondary; client sent no/old Authorization header to a primary-only endpoint.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• No such user exists: {actingUsername}
• Access was denied.
• Failed to read 'Zones' permissions: auth.config file is prob
• Failed to find 'Administrators' group: auth.config file is p
• Failed to find 'DNS Administrators' group: auth.config file

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/1c749095a438978e. Report an issue: GitHub.