{"record":{"id":"1d0cb285c12786f7","repo":"mastra-ai/mastra","slug":"session-expired","errorCode":null,"errorMessage":"Session expired","messagePattern":"Session expired","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"packages/server/src/server/handlers/auth.ts","lineNumber":633,"sourceCode":"\n      if (\n        !auth ||\n        !implementsInterface<ISessionProvider>(auth, 'refreshSession') ||\n        !implementsInterface<ISessionProvider>(auth, 'getSessionIdFromRequest')\n      ) {\n        throw new HTTPException(404, { message: 'Session refresh not configured' });\n      }\n\n      // Get session ID from request\n      const sessionId = auth.getSessionIdFromRequest(request);\n      if (!sessionId) {\n        throw new HTTPException(401, { message: 'No session' });\n      }\n\n      // Refresh the session\n      const newSession = await auth.refreshSession(sessionId);\n      if (!newSession) {\n        throw new HTTPException(401, { message: 'Session expired' });\n      }\n\n      // Build response with new session headers\n      const headers = new Headers({ 'Content-Type': 'application/json' });\n      if (implementsInterface<ISessionProvider>(auth, 'getSessionHeaders')) {\n        const sessionHeaders = auth.getSessionHeaders(newSession);\n        for (const [key, value] of Object.entries(sessionHeaders)) {\n          headers.append(key, value);\n        }\n      }\n\n      return new Response(JSON.stringify({ success: true }), {\n        status: 200,\n        headers,\n      });\n    } catch (error) {\n      if (error instanceof HTTPException) throw error;\n      return handleError(error, 'Error refreshing session');","sourceCodeStart":615,"sourceCodeEnd":651,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/packages/server/src/server/handlers/auth.ts#L615-L651","documentation":"This HTTP 401 error is thrown when `auth.refreshSession(sessionId)` resolves to null/undefined — the provider recognized the session ID but could not renew it, typically because the session expired server-side or no longer exists.","triggerScenarios":"POST the session refresh endpoint with a session ID that the provider cannot refresh: expired beyond the refresh window, revoked, or deleted from the session store.","commonSituations":"User idle past session TTL; server restarted with an in-memory session store losing all sessions; refresh attempted after absolute expiry (refresh tokens only renew within limits).","solutions":["Treat 401 as sign-out: redirect the user to the sign-in flow to establish a fresh session.","Refresh sessions proactively before TTL expiry rather than after; increase session/refresh TTL in provider config if appropriate.","If sessions vanish on deploy, use a persistent session store instead of in-memory."],"exampleFix":"// before\nconst res = await refreshSession(); // throws 401 after expiry\n// after\nconst res = await refreshSession();\nif (res.status === 401) redirectToSignIn();","handlingStrategy":"fallback","validationCode":"// optionally track last-refresh time client-side and refresh before typical TTL\nconst REFRESH_INTERVAL_MS = 10 * 60 * 1000;\nif (Date.now() - lastRefreshAt > REFRESH_INTERVAL_MS) scheduleRefresh();","typeGuard":null,"tryCatchPattern":"try {\n  const res = await fetch('/api/auth/session/refresh', { method: 'POST', credentials: 'include' });\n  if (res.status === 401) {\n    await signInAgain(); // session expired: full re-auth\n  }\n} catch (e) { redirectToSignIn(); }","preventionTips":["Refresh tokens proactively on a timer or on user activity, before expiry.","Never retry refresh in a loop on 401 — it will always fail once the session is dead.","Use a persistent session store server-side so deploys don't invalidate sessions."],"tags":["http-401","session-expired","authentication"],"backgroundTag":"session-expired","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}