{"record":{"id":"0208d839543ca407","repo":"m1k1o/neko","slug":"no-authentication-provided","errorCode":null,"errorMessage":"no authentication provided","messagePattern":"no authentication provided","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"server/internal/session/auth.go","lineNumber":44,"sourceCode":"\t\tPath:     manager.config.Cookie.Path,\n\t})\n}\n\nfunc (manager *SessionManagerCtx) CookieClearToken(w http.ResponseWriter, r *http.Request) {\n\tcookie, err := r.Cookie(manager.config.Cookie.Name)\n\tif err != nil {\n\t\treturn\n\t}\n\n\tcookie.Value = \"\"\n\tcookie.Expires = time.Unix(0, 0)\n\thttp.SetCookie(w, cookie)\n}\n\nfunc (manager *SessionManagerCtx) Authenticate(r *http.Request) (types.Session, error) {\n\ttoken, ok := manager.getToken(r)\n\tif !ok {\n\t\treturn nil, errors.New(\"no authentication provided\")\n\t}\n\n\tsession, ok := manager.GetByToken(token)\n\tif !ok {\n\t\treturn nil, types.ErrSessionNotFound\n\t}\n\n\tif !session.Profile().CanLogin {\n\t\treturn nil, types.ErrSessionLoginDisabled\n\t}\n\n\treturn session, nil\n}\n\nfunc (manager *SessionManagerCtx) getToken(r *http.Request) (string, bool) {\n\tif manager.CookieEnabled() {\n\t\t// get from Cookie\n\t\tcookie, err := r.Cookie(manager.config.Cookie.Name)","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/m1k1o/neko/blob/b0f01cedea68893e85a3fd852c0521238c285695/server/internal/session/auth.go#L26-L62","documentation":"SessionManagerCtx.Authenticate extracts a session token from the incoming HTTP request (via getToken, e.g. cookie or header). If no token can be found in the request, it returns this error before attempting any session lookup. It indicates the request carried no credentials at all, as opposed to an invalid/expired token (which yields types.ErrSessionNotFound).","triggerScenarios":"Any request to endpoints wrapped by the session Authenticate middleware without a session token: no session cookie set and no token header/query parameter present — typically a completely unauthenticated first request.","commonSituations":"A user opens the app before ever logging in; API clients (curl/scripts) that omit the auth cookie or Authorization/token header; browser cookie blocking or clearing sessions; misconfigured reverse proxy stripping cookies.","solutions":["Log in / create a session first (the login endpoint sets the session cookie) and retry the request with credentials included.","Ensure the HTTP client sends cookies or the token header (e.g. curl --cookie / withCredentials: true in fetch/XHR).","Check that no reverse proxy or browser setting strips the session cookie between client and server.","Confirm the token's transport matches what getToken reads (cookie vs header) as expected by the server configuration."],"exampleFix":"// before: request without credentials\nfetch(\"/api/session\", { method: \"GET\" })\n\n// after: include session cookie\nfetch(\"/api/session\", { method: \"GET\", credentials: \"include\" })","handlingStrategy":"try-catch","validationCode":"hasToken := document.cookie.includes(\"neko_session\") // or the configured cookie name\nif !hasToken {\n    redirectToLogin() // avoid calling authenticated endpoints without credentials\n}","typeGuard":"func hasAuthToken(r *http.Request) bool {\n    _, ok := r.Cookie(\"neko_session\") // or check configured header\n    return ok\n}","tryCatchPattern":"session, err := manager.Authenticate(r)\nif err != nil {\n    if err.Error() == \"no authentication provided\" {\n        http.Error(w, \"authentication required\", http.StatusUnauthorized)\n        return\n    }\n    if errors.Is(err, types.ErrSessionNotFound) {\n        http.Error(w, \"session expired\", http.StatusUnauthorized)\n        return\n    }\n    http.Error(w, \"internal error\", http.StatusInternalServerError)\n    return\n}","preventionTips":["Always log in to obtain the session cookie/token before calling authenticated endpoints.","Send credentials with every request (credentials: \"include\", curl --cookie, or the token header).","Distinguish 'no authentication provided' from ErrSessionNotFound to decide redirect-to-login vs re-auth.","Verify reverse proxies forward cookies and don't strip Authorization headers.","Check that cookies aren't blocked or cleared by browser settings before diagnosing server-side issues."],"tags":["authentication","http","session","cookie"],"backgroundTag":"missing-auth-credentials","analyzedSha":"b0f01cedea68893e85a3fd852c0521238c285695","analyzedAt":"2026-09-01T10:35:56.638Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}