{"record":{"id":"350cc254a99cf961","repo":"vxcontrol/pentagi","slug":"cookie-claim-invalid","errorCode":null,"errorMessage":"cookie claim invalid","messagePattern":"cookie claim invalid","errorType":"http","errorClass":null,"httpStatus":401,"severity":"warning","filePath":"backend/pkg/server/auth/auth_middleware.go","lineNumber":110,"sourceCode":"// isRoutineAuthFailure reports whether authErr represents an expected,\n// non-malicious session/token invalidation rather than a genuine application\n// error, so callers can log it at a quieter level.\nfunc isRoutineAuthFailure(authErr error) bool {\n\treturn errors.Is(authErr, errCookieClaimInvalid) ||\n\t\terrors.Is(authErr, errSessionExpired) ||\n\t\terrors.Is(authErr, errUserHashMismatch)\n}\n\n// errCookieClaimInvalid is returned by tryUserCookieAuthentication when the\n// session cookie is present but missing one or more required claims (expired\n// or otherwise invalid session) - a routine, expected condition.\n//\n// errSessionExpired and errUserHashMismatch mark the same category of routine\n// session/token invalidation, just detected a bit later during validation: a\n// session past its TTL, or a stored hash that no longer matches the user\n// record (e.g. after a password change or a test database reseed).\nvar (\n\terrCookieClaimInvalid = errors.New(\"cookie claim invalid\")\n\terrSessionExpired     = errors.New(\"session expired\")\n\terrUserHashMismatch   = errors.New(\"user hash mismatch\")\n)\n\nfunc (p *AuthMiddleware) tryUserCookieAuthentication(c *gin.Context) (authResult, error) {\n\tsessionObject, exists := c.Get(sessions.DefaultKey)\n\tif !exists {\n\t\treturn authResultSkip, errors.New(\"can't find session object\")\n\t}\n\n\tsession, ok := sessionObject.(sessions.Session)\n\tif !ok {\n\t\treturn authResultFail, errors.New(\"not a session object\")\n\t}\n\n\tuid := session.Get(\"uid\")\n\tuhash := session.Get(\"uhash\")\n\trid := session.Get(\"rid\")","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/vxcontrol/pentagi/blob/ea665308baaff015b226f308438a68d929d0f29b/backend/pkg/server/auth/auth_middleware.go#L92-L128","documentation":"errCookieClaimInvalid signals that a session cookie was presented but is missing or has an invalid required claim (e.g. user id or user hash field absent/wrong type in the session). The middleware treats it as a routine auth failure rather than a server error: the request is rejected, typically with a 401, and the client should re-authenticate.","triggerScenarios":"A request arrives with a session cookie whose stored claims cannot be validated — cookie forged/corrupted, session data written by an older version with a different claim layout, or the cookie's user-id/hash values are not the expected types when read in tryUserCookieAuthentication.","commonSituations":"Server upgraded and session claim schema changed while old cookies persist in browsers; sessions store backend (cookie store) truncated or key rotated; user manually edited cookies; load balancer sends the request to an installation different from the one that issued the cookie.","solutions":["Clear the session cookie and log in again to get a fresh, valid session","If it reproduces after login, verify the session store backend and its secret/key are consistent across instances","After a server upgrade, bump/rotate sessions or accept that old cookies are invalidated and users must re-login"],"exampleFix":"// before\n// client silently retries with the stale cookie\n// after\naxios.interceptors.response.use(null, (err) => {\n  if (err.response?.status === 401) {\n    window.location.href = '/login';\n  }\n  return Promise.reject(err);\n});","handlingStrategy":"try-catch","validationCode":"const hasSessionCookie = document.cookie.split(';').some(c => c.trim().startsWith('session='));","typeGuard":null,"tryCatchPattern":"axios.interceptors.response.use(null, (err) => {\n  if (err.response?.status === 401 && /cookie claim invalid|session/.test(JSON.stringify(err.response.data ?? ''))) {\n    window.location.href = '/login';\n  }\n  return Promise.reject(err);\n});","preventionTips":["Redirect to login on 401 responses instead of retrying with the stale cookie","Clear cookies after server upgrades that change session claim schemas","Use a server-side session store so cookies survive schema/key rotations predictably"],"tags":["authentication","session","cookies"],"backgroundTag":"session-cookie-invalid","analyzedSha":"ea665308baaff015b226f308438a68d929d0f29b","analyzedAt":"2026-09-01T14:16:31.421Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}