{"record":{"id":"10e420ae429e8b65","repo":"Mintplex-Labs/anything-llm","slug":"invalid-session-id","errorCode":null,"errorMessage":"Invalid session ID.","messagePattern":"Invalid session ID\\.","errorType":"http","errorClass":null,"httpStatus":404,"severity":"error","filePath":"server/utils/middleware/embedMiddleware.js","lineNumber":100,"sourceCode":"      });\n      return;\n    }\n\n    if (allowedHosts !== null && !allowedHosts.includes(host)) {\n      response.status(401).json({\n        id: uuidv4(),\n        type: \"abort\",\n        textResponse: null,\n        sources: [],\n        close: true,\n        error: \"Invalid request.\",\n      });\n      return;\n    }\n\n    const { sessionId, message } = reqBody(request);\n    if (typeof sessionId !== \"string\" || !validate(String(sessionId))) {\n      response.status(404).json({\n        id: uuidv4(),\n        type: \"abort\",\n        textResponse: null,\n        sources: [],\n        close: true,\n        error: \"Invalid session ID.\",\n      });\n      return;\n    }\n\n    if (!message?.length || !VALID_CHAT_MODE.includes(embed.chat_mode)) {\n      response.status(400).json({\n        id: uuidv4(),\n        type: \"abort\",\n        textResponse: null,\n        sources: [],\n        close: true,\n        error: !message?.length","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/3aec848f2885144aa8f1e53b9731a04310d5d558/server/utils/middleware/embedMiddleware.js#L82-L118","documentation":"Session validation inside canRespond: the body's sessionId must be a string and pass uuid validate(); otherwise HTTP 404 with an abort payload 'Invalid session ID.'. The 404 status (not 400) reflects that the session does not exist. Widgets are expected to generate one UUID per conversation and keep sending it for follow-ups.","triggerScenarios":"POSTing a chat message with sessionId missing, null, a number, or any non-UUID string ('session-1', 'abc', a nanoid); sending an unquoted UUID in form-encoded bodies; forgetting to persist the generated id between messages so every send uses a fresh invalid value.","commonSituations":"Custom widget integrations that use their own incremental ids; JSON serialization dropping the field; SSR frameworks rendering the widget before the id is created.","solutions":["Generate the session id once per conversation with crypto.randomUUID() and reuse it for all messages in that conversation","Ensure the body field is exactly sessionId and is a string UUID","If integrating server-side, keep the uuid with the user's conversation state (e.g. localStorage/session storage in a widget)"],"exampleFix":"// before\nbody: JSON.stringify({ sessionId: 'session-1', message: text }) // -> 404 Invalid session ID.\n\n// after\nconst sessionId = crypto.randomUUID(); // once per conversation, then reuse\nbody: JSON.stringify({ sessionId, message: text })","handlingStrategy":"type-guard","validationCode":"const { validate } = require('uuid');\nconst sessionId = store.get('embedSessionId') ?? crypto.randomUUID();\nstore.set('embedSessionId', sessionId);\nif (!validate(sessionId)) throw new Error('sessionId must be a UUID');","typeGuard":"const isValidSessionId = (id) =>\n  typeof id === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id);\n// or: const { validate } = require('uuid'); const isValidSessionId = (id) => typeof id === 'string' && validate(id);","tryCatchPattern":"if (res.status === 404) {\n  const data = await res.json();\n  if (/Invalid session ID/.test(data.error ?? '')) resetSessionId(); // regenerate and retry once\n}","preventionTips":["Create the session UUID once and persist it for the whole conversation","Never send custom incremental ids to embed endpoints","Guard the request builder with the UUID validator"],"tags":["embed","uuid","session","validation","http-404"],"backgroundTag":"uuid-validation-failed","analyzedSha":"3aec848f2885144aa8f1e53b9731a04310d5d558","analyzedAt":"2026-08-18T10:02:21.017Z","contentChangedAt":"2026-08-18T10:02:21.017Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}