{"record":{"id":"210dd5d004ed6c3c","repo":"langflow-ai/langflow","slug":"invalid-refresh-token","errorCode":null,"errorMessage":"Invalid refresh token","messagePattern":"Invalid refresh token","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"warning","filePath":"src/backend/base/langflow/api/v1/login.py","lineNumber":202,"sourceCode":"            \"refresh_token_lf\",\n            tokens[\"refresh_token\"],\n            httponly=auth_settings.REFRESH_HTTPONLY,\n            samesite=auth_settings.REFRESH_SAME_SITE,\n            secure=auth_settings.REFRESH_SECURE,\n            expires=auth_settings.REFRESH_TOKEN_EXPIRE_SECONDS,\n            domain=auth_settings.COOKIE_DOMAIN,\n        )\n        response.set_cookie(\n            \"access_token_lf\",\n            tokens[\"access_token\"],\n            httponly=auth_settings.ACCESS_HTTPONLY,\n            samesite=auth_settings.ACCESS_SAME_SITE,\n            secure=auth_settings.ACCESS_SECURE,\n            expires=auth_settings.ACCESS_TOKEN_EXPIRE_SECONDS,\n            domain=auth_settings.COOKIE_DOMAIN,\n        )\n        return tokens\n    raise HTTPException(\n        status_code=status.HTTP_401_UNAUTHORIZED,\n        detail=\"Invalid refresh token\",\n        headers={\"WWW-Authenticate\": \"Bearer\"},\n    )\n\n\n@router.get(\"/session\", include_in_schema=False)\nasync def get_session(\n    request: Request,\n    db: DbSession,\n) -> SessionResponse:\n    \"\"\"Validate session and return user information.\n\n    This endpoint checks if the user is authenticated via cookie or Authorization header.\n    It does not raise an error if unauthenticated, allowing the frontend to gracefully\n    handle the session state.\n    \"\"\"\n    from langflow.services.auth.utils import _get_external_token, oauth2_login","sourceCodeStart":184,"sourceCodeEnd":220,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/login.py#L184-L220","documentation":"401 from POST /api/v1/auth/refresh (include_in_schema) when the refresh token cookie ('refresh_token_lf') is absent, expired, revoked, or fails validation. Includes WWW-Authenticate: Bearer. The refresh cookie is long-lived; this error means the session truly ended and the client must re-authenticate.","triggerScenarios":"POST /refresh after cookie expiry, after logout revoked the token, cross-domain cookie not sent (COOKIE_DOMAIN mismatch), or a fresh browser with no prior login.","commonSituations":"Long-idle tab waking up past the refresh window; cookie blocked in embedded iframes / third-party contexts; server restart with a new LANGFLOW_SECRET_KEY invalidating old signed tokens; clock skew.","solutions":["Redirect the user to the login page and POST /login again to mint fresh cookies","Verify cookies are actually sent (same-site policy, COOKIE_DOMAIN matches the host)","Ensure LANGFLOW_SECRET_KEY is stable across restarts so tokens survive deploys"],"exampleFix":"// before\nconst { data } = await api.post('/api/v1/auth/refresh');\n\n// after\ntry {\n  const { data } = await api.post('/api/v1/auth/refresh');\n} catch (e) {\n  if (e.response?.status === 401) window.location.href = '/login'; // session over\n}","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"try:\n    await client.post(\"/api/v1/auth/refresh\")\nexcept httpx.HTTPStatusError as e:\n    if e.response.status_code == 401:\n        await credential_login(client)  # refresh cookie dead: full re-login\n    else:\n        raise","preventionTips":["Treat refresh-401 as end-of-session: redirect to login, never loop refresh retries","Keep LANGFLOW_SECRET_KEY stable so cookies survive server restarts","Ensure COOKIE_DOMAIN / same-site settings allow the cookie on your host"],"tags":["auth","refresh-token","http-401","session","langflow"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}