{"record":{"id":"344f01d491edc5d4","repo":"Mintplex-Labs/anything-llm","slug":"token-expired-or-failed-validation","errorCode":null,"errorMessage":"Token expired or failed validation.","messagePattern":"Token expired or failed validation\\.","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"server/utils/middleware/validatedRequest.js","lineNumber":47,"sourceCode":"    });\n    return;\n  }\n\n  const auth = request.header(\"Authorization\");\n  const token = auth ? auth.split(\" \")[1] : null;\n\n  if (!token) {\n    response.status(401).json({\n      error: \"No auth token found.\",\n    });\n    return;\n  }\n\n  const bcrypt = require(\"bcryptjs\");\n  const { p } = decodeJWT(token);\n\n  if (p === null || !/\\w{32}:\\w{32}/.test(p)) {\n    response.status(401).json({\n      error: \"Token expired or failed validation.\",\n    });\n    return;\n  }\n\n  // Since the blame of this comment we have been encrypting the `p` property of JWTs with the persistent\n  // encryptionManager PEM's. This prevents us from storing the `p` unencrypted in the JWT itself, which could\n  // be unsafe. As a consequence, existing JWTs with invalid `p` values that do not match the regex\n  // in ln:44 will be marked invalid so they can be logged out and forced to log back in and obtain an encrypted token.\n  // This kind of methodology only applies to single-user password mode.\n  if (\n    !bcrypt.compareSync(\n      EncryptionMgr.decrypt(p),\n      bcrypt.hashSync(process.env.AUTH_TOKEN, 10)\n    )\n  ) {\n    response.status(401).json({\n      error: \"Invalid auth credentials.\",","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/3aec848f2885144aa8f1e53b9731a04310d5d558/server/utils/middleware/validatedRequest.js#L29-L65","documentation":"Token guard in validatedRequest (single-user mode): the JWT's decoded p claim is null or fails the 32:32 format regex, meaning the token is expired, legacy, or malformed, so the session is rejected with 401 and a re-login is forced.","triggerScenarios":"Auth token expired or failed JWT validation. Triggered when token verification fails in validatedRequest (validatedRequest.js:47).","commonSituations":"See trigger scenarios.","solutions":["Log in again to obtain a fresh JWT — the current token is expired or malformed.","Ensure the token is passed unmodified as 'Bearer <token>' and JWT_SECRET has not changed."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3aec848f2885144aa8f1e53b9731a04310d5d558","analyzedAt":"2026-08-18T10:02:21.017Z","contentChangedAt":"2026-08-18T10:02:21.017Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}