{"record":{"id":"09dc4934ae1e7623","repo":"jackwener/OpenCLI","slug":"csrftoken-cookie-missing-make-sure-you-are-logge-09dc49","errorCode":null,"errorMessage":"csrftoken cookie missing - make sure you are logged in to Instagram","messagePattern":"csrftoken cookie missing - make sure you are logged in to Instagram","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"clis/instagram/collection-delete.js","lineNumber":27,"sourceCode":"        {\n            name: 'target',\n            required: true,\n            positional: true,\n            help: 'Collection name (case-insensitive) or numeric collection_id',\n        },\n    ],\n    columns: ['status', 'collectionId', 'collectionName'],\n    pipeline: [\n        { navigate: 'https://www.instagram.com' },\n        { evaluate: `(async () => {\n  const target = \\${{ args.target | json }};\n  if (!target || !String(target).trim()) {\n    throw new Error('Collection target (name or id) cannot be empty');\n  }\n  const raw = String(target).trim();\n  const csrf = document.cookie.match(/csrftoken=([^;]+)/)?.[1] || '';\n  if (!csrf) {\n    throw new Error('csrftoken cookie missing - make sure you are logged in to Instagram');\n  }\n  const headers = { 'X-IG-App-ID': '936619743392459' };\n\n  // Resolve name -> id via /collections/list/. Always go through this path so we can\n  // surface an explicit error on duplicate names or unknown names instead of relying\n  // on a 404.\n  const listRes = await fetch('https://www.instagram.com/api/v1/collections/list/?collection_types=%5B%22MEDIA%22%5D', {\n    credentials: 'include',\n    headers,\n  });\n  if (!listRes.ok) {\n    throw new Error('Failed to list collections: HTTP ' + listRes.status + ' - make sure you are logged in to Instagram');\n  }\n  const listData = await listRes.json();\n  const collections = listData?.items || [];\n  const isNumericId = /^\\\\d{6,}$/.test(raw);\n  let id = '';\n  let resolvedName = '';","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/jackwener/OpenCLI/blob/49907e53dc3ade5c223ff0c4c2c2785687cec4e6/clis/instagram/collection-delete.js#L9-L45","documentation":"Same family as error 1940: thrown when the delete pipeline's browser context has no csrftoken cookie, which is required for the X-CSRFToken header on the delete request. It guards before the collections/list call so the request isn't doomed. Indicates an unauthenticated or cookie-less session.","triggerScenarios":"Browser context not logged into Instagram, expired session, cleared cookies, incognito profile, or document.cookie not exposing csrftoken when the delete pipeline runs.","commonSituations":"CI running with a fresh profile; overnight session expiry; privacy extensions blocking cookies; pointing the automation at the wrong (logged-out) page state.","solutions":["Log in to Instagram in the automation's browser profile and retry","Confirm csrftoken exists via DevTools Application > Cookies for instagram.com","Re-authenticate if the session expired","Ensure the pipeline navigates to https://www.instagram.com before evaluating"],"exampleFix":"// before\nawait page.goto('https://www.instagram.com');\n// csrf read immediately\n// after\nawait page.goto('https://www.instagram.com');\nawait waitForLogin(page); // block until csrftoken cookie exists\n// csrf read after","handlingStrategy":"validation","validationCode":"const hasCsrf = () => /(?:^|;\\s*)csrftoken=/.test(document.cookie);\nif (!hasCsrf()) throw new Error('Not logged in: csrftoken cookie absent');","typeGuard":"function hasCsrfCookie(): boolean {\n  return document.cookie.split(';').some((c) => c.trim().startsWith('csrftoken='));\n}","tryCatchPattern":"try {\n  await deleteCollection(target);\n} catch (e) {\n  if (String(e.message).includes('csrftoken cookie missing')) {\n    await loginToInstagram();\n    return deleteCollection(target);\n  }\n  throw e;\n}","preventionTips":["Gate all Instagram automation behind a login check","Use persistent profiles and monitor session expiry","Navigate to instagram.com and confirm authenticated state before evaluating scripts","Disable cookie-blocking extensions in automation profiles"],"tags":["authentication","csrf","cookies","browser-automation"],"backgroundTag":"missing-csrf-token","analyzedSha":"49907e53dc3ade5c223ff0c4c2c2785687cec4e6","analyzedAt":"2026-08-29T08:14:47.543Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}