TechnitiumSoftware/DnsServer · error · HttpApiClientException

No active session exist to logout.

Error message

No active session exist to logout.

What it means

LogoutAsync requires an active session. It checks _loggedIn and throws this HttpApiClientException if false, because there is no Authorization header to clear and no session to terminate server-side. The guard runs before any HTTP request is made.

Source

Thrown at DnsServerCore.HttpApi/HttpApiClient.cs:210

            using JsonDocument jsonDoc = await JsonDocument.ParseAsync(httpResponse.Content.ReadAsStream(cancellationToken), cancellationToken: cancellationToken);
            JsonElement rootElement = jsonDoc.RootElement;

            CheckResponseStatus(rootElement);

            SessionInfo? sessionInfo = rootElement.Deserialize<SessionInfo>(_serializerOptions);
            if (sessionInfo is null)
                throw new HttpApiClientException("Invalid JSON response was received.");

            _httpClient.DefaultRequestHeaders.Add("Authorization", "Bearer " + sessionInfo.Token);
            _loggedIn = true;

            return sessionInfo;
        }

        public async Task LogoutAsync(CancellationToken cancellationToken = default)
        {
            if (!_loggedIn)
                throw new HttpApiClientException("No active session exist to logout.");

            Stream stream = await _httpClient.GetStreamAsync($"api/user/logout", cancellationToken);

            using JsonDocument jsonDoc = await JsonDocument.ParseAsync(stream, cancellationToken: cancellationToken);
            JsonElement rootElement = jsonDoc.RootElement;

            CheckResponseStatus(rootElement);

            _httpClient.DefaultRequestHeaders.Remove("Authorization");
            _loggedIn = false;
        }

        public void UseApiToken(string token)
        {
            if (_loggedIn)
                throw new HttpApiClientException("Already logged in. Please create a new object to use a different API token.");

            _httpClient.DefaultRequestHeaders.Add("Authorization", "Bearer " + token);

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Guard LogoutAsync with a check of the logged-in state (or wrap in try/catch).
2. Only call logout after a confirmed successful login.
3. Track session state in your own code to avoid redundant logout calls.

Example fix

// before
await client.LogoutAsync(); // throws if never logged in

// after
if (client.IsLoggedIn) // or track via your own bool
    await client.LogoutAsync();

if (client.IsLoggedIn)
    await client.LogoutAsync();

catch (HttpApiClientException ex) when (ex.Message == "No active session exist to logout.")
{
    // benign: nothing to do, swallow or log at debug
}

When it happens

Trigger: Calling LogoutAsync on a freshly constructed HttpApiClient, or after a previous LogoutAsync/failed login left _loggedIn false.

Common situations: Logout logic in a finally/dispose path that runs even when login never succeeded; calling logout twice; cleanup code that does not track session state.

Related errors

• Already logged in.
• Already logged in. Please create a new object to use a diffe
• No active session exists. Please login and try again.
• Invalid JSON response was received.
• Unknown status value was received: {status}

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/29788368e045f904. Report an issue: GitHub.