{"record":{"id":"038285255e683f02","repo":"m1k1o/neko","slug":"token-not-found-make-sure-you-are-not-using-cook","errorCode":null,"errorMessage":"token not found - make sure you are not using Cookie auth on the server","messagePattern":"token not found - make sure you are not using Cookie auth on the server","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/internal/http/legacy/session.go","lineNumber":194,"sourceCode":"\tdata := api.SessionDataPayload{}\n\n\terr := s.apiReq(http.MethodPost, \"/api/login\", api.SessionLoginPayload{\n\t\tUsername: username,\n\t\tPassword: password,\n\t}, &data)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\ts.id, s.ip = data.ID, getIp(s.r)\n\ts.h.sessionIPs[s.id] = s.ip // save session ip by id\n\ts.token = data.Token\n\ts.name = data.Profile.Name\n\ts.isAdmin = data.Profile.IsAdmin\n\n\t// if Cookie auth, the token will be empty\n\tif s.token == \"\" {\n\t\treturn fmt.Errorf(\"token not found - make sure you are not using Cookie auth on the server\")\n\t}\n\n\treturn nil\n}\n\nfunc (s *session) destroy() {\n\tdefer s.client.CloseIdleConnections()\n\n\t// logout session\n\terr := s.apiReq(http.MethodPost, \"/api/logout\", nil, nil)\n\tif err != nil {\n\t\ts.logger.Error().Err(err).Msg(\"failed to logout\")\n\t}\n\n\t// remove session id from ip map\n\tdelete(s.h.sessionIPs, s.id)\n}\n","sourceCodeStart":176,"sourceCodeEnd":212,"githubUrl":"https://github.com/m1k1o/neko/blob/b0f01cedea68893e85a3fd852c0521238c285695/server/internal/http/legacy/session.go#L176-L212","documentation":"This error is returned by session.create after a successful login response when data.Token is empty. The legacy proxy expects token-based auth; if the backend is configured for Cookie-based authentication it does not return a token in the login payload, so the proxy cannot attach a token to subsequent API requests. It is a configuration/compatibility error telling the operator to switch the backend to token auth.","triggerScenarios":"Calling session.create against a backend configured with Cookie auth — the login/creation response succeeds (profile fields populated) but data.Token is \"\", triggering the guard at session.go:194.","commonSituations":"Migrating from a Cookie-auth backend deployment to the legacy token-based proxy; backend auth mode changed by upgrade or config flag; mixing auth modes between proxy and backend.","solutions":["Switch the backend to token-based authentication so login responses include a token.","Confirm with the backend release notes which auth mode is supported; align proxy version accordingly.","If Cookie auth must be kept, use a proxy variant that forwards cookies instead of requiring a bearer token.","Verify the login response actually contains a token field populated (inspect response payload) to rule out a partial/unmarshal issue."],"exampleFix":"// before\n# backend config\nauth:\n  mode: cookie\n// after\n# backend config\nauth:\n  mode: token  # legacy proxy requires a token in the login response","handlingStrategy":"validation","validationCode":"if data.Profile.Name == \"\" || data.Token == \"\" {\n    return errors.New(\"login response missing token; is the backend using cookie auth?\")\n}","typeGuard":"func loginHasToken(data *loginResponse) bool {\n    return data != nil && data.Token != \"\"\n}","tryCatchPattern":"if err := s.create(); err != nil {\n    if strings.Contains(err.Error(), \"token not found\") {\n        return fmt.Errorf(\"backend must use token auth, not cookie auth: %w\", err)\n    }\n    return err\n}","preventionTips":["Set backend auth mode to token when using the legacy proxy.","Check backend release notes for auth-mode changes after upgrades.","Validate the login payload shape once at deployment time.","Do not mix cookie-auth backends with token-expecting proxies."],"tags":["auth","token","configuration"],"backgroundTag":"missing-auth-token","analyzedSha":"b0f01cedea68893e85a3fd852c0521238c285695","analyzedAt":"2026-09-01T10:35:56.638Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}