{"record":{"id":"3259fde61b541060","repo":"mastra-ai/mastra","slug":"no-session","errorCode":null,"errorMessage":"No session","messagePattern":"No session","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"packages/server/src/server/handlers/auth.ts","lineNumber":627,"sourceCode":"  handler: async ctx => {\n    const { mastra, request } = ctx as any;\n    const isStudio = isStudioRequest(request);\n\n    try {\n      const auth = getAuthProvider(mastra, isStudio);\n\n      if (\n        !auth ||\n        !implementsInterface<ISessionProvider>(auth, 'refreshSession') ||\n        !implementsInterface<ISessionProvider>(auth, 'getSessionIdFromRequest')\n      ) {\n        throw new HTTPException(404, { message: 'Session refresh not configured' });\n      }\n\n      // Get session ID from request\n      const sessionId = auth.getSessionIdFromRequest(request);\n      if (!sessionId) {\n        throw new HTTPException(401, { message: 'No session' });\n      }\n\n      // Refresh the session\n      const newSession = await auth.refreshSession(sessionId);\n      if (!newSession) {\n        throw new HTTPException(401, { message: 'Session expired' });\n      }\n\n      // Build response with new session headers\n      const headers = new Headers({ 'Content-Type': 'application/json' });\n      if (implementsInterface<ISessionProvider>(auth, 'getSessionHeaders')) {\n        const sessionHeaders = auth.getSessionHeaders(newSession);\n        for (const [key, value] of Object.entries(sessionHeaders)) {\n          headers.append(key, value);\n        }\n      }\n\n      return new Response(JSON.stringify({ success: true }), {","sourceCodeStart":609,"sourceCodeEnd":645,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/packages/server/src/server/handlers/auth.ts#L609-L645","documentation":"This HTTP 401 error is thrown when the auth provider's `getSessionIdFromRequest(request)` returns null/undefined, meaning no session identifier (cookie, bearer token, header) could be extracted from the incoming request.","triggerScenarios":"POST the session refresh endpoint without a valid session ID present in the request — missing/blank auth cookie, missing Authorization header, or a malformed credential the provider cannot parse.","commonSituations":"Calling the refresh endpoint before ever signing in; cookies stripped by CORS (credentials: 'omit' or SameSite blocking); token stored under a header/cookie name the provider doesn't read; expired token deleted client-side.","solutions":["Sign in first to obtain a session and ensure the session cookie/token is sent with the refresh request (credentials: 'include' for cross-origin fetches).","Confirm the session is transmitted where getSessionIdFromRequest looks for it (cookie name/header scheme).","Fix CORS/cookie SameSite settings so the browser actually attaches the session cookie."],"exampleFix":"// before\nfetch('/api/auth/session/refresh', { method: 'POST' });\n// after\nfetch('/api/auth/session/refresh', { method: 'POST', credentials: 'include' });","handlingStrategy":"validation","validationCode":"// ensure a session credential exists before calling refresh\nif (!document.cookie.includes('mastra-session') && !localStorage.getItem('sessionToken')) {\n  redirectToSignIn(); // no session to refresh\n}","typeGuard":"function hasSessionId(req: Request): boolean {\n  return req.headers.has('authorization') || req.headers.has('cookie');\n}","tryCatchPattern":"try {\n  const res = await fetch('/api/auth/session/refresh', { method: 'POST', credentials: 'include' });\n  if (res.status === 401) redirectToSignIn(); // no session present\n} catch (e) { redirectToSignIn(); }","preventionTips":["Always send credentials: 'include' on auth fetches so cookies are attached.","Check for an existing session before issuing refresh requests.","Fix CORS and SameSite settings so session cookies are transmitted."],"tags":["http-401","session","authentication"],"backgroundTag":"missing-session-token","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}