{"record":{"id":"486925da9bca3aae","repo":"n8n-io/n8n","slug":"401","errorCode":"401","errorMessage":"Unauthorized","messagePattern":"Unauthorized","errorType":"http","errorClass":"AuthError","httpStatus":401,"severity":"error","filePath":"packages/cli/src/auth/auth.service.ts","lineNumber":290,"sourceCode":"\t *\n\t * @returns the authenticated `User` on success\n\t * @throws `AuthError('Unauthorized')` if the token is revoked or invalid\n\t */\n\tasync validateCookieToken(token: string): Promise<User> {\n\t\tconst isInvalid = await this.invalidAuthTokenRepository.existsBy({ token });\n\t\tif (isInvalid) throw new AuthError('Unauthorized');\n\t\tconst { user } = await this.validateToken(token);\n\t\treturn user;\n\t}\n\n\tasync authenticateUserBasedOnToken(\n\t\ttoken: string,\n\t\tmethod: string,\n\t\tendpoint: string,\n\t\tbrowserId: string | undefined,\n\t): Promise<User> {\n\t\tconst isInvalid = await this.invalidAuthTokenRepository.existsBy({ token });\n\t\tif (isInvalid) throw new AuthError('Unauthorized');\n\n\t\tconst { user, jwtPayload } = await this.validateToken(token);\n\n\t\tthis.validateBrowserId(jwtPayload, browserId, endpoint, method);\n\n\t\tawait this.checkMfaGate(user, jwtPayload);\n\n\t\treturn user;\n\t}\n\n\t/**\n\t * Validates an n8n auth cookie (JWT) without request-bound checks (browserId / endpoint / method).\n\t *\n\t * Use when the cookie was captured at the controller boundary and must be re-validated\n\t * later in the execution lifecycle, after the original HTTP request is no longer available.\n\t *\n\t * @param cookie - The JWT string extracted from the `n8n-auth` browser cookie.\n\t */","sourceCodeStart":272,"sourceCodeEnd":308,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/cli/src/auth/auth.service.ts#L272-L308","documentation":"authenticateUserBasedOnToken throws AuthError('Unauthorized') (status 401) when the token is revoked (found in invalidAuthTokenRepository). This is the per-request token revocation gate used by the resolveJwt path before browser-id and MFA checks run.","triggerScenarios":"A request reaches authenticateUserBasedOnToken with a token that exists in the invalid auth tokens table. The check fires immediately, before JWT verification, browserId binding, or MFA gate evaluation.","commonSituations":"User logged out but the client kept sending the old cookie; admin force-logged out all sessions; password reset invalidated existing tokens; replay of a captured token after revocation.","solutions":["Re-authenticate to get a new token; the old one is permanently revoked.","If revocation is unexpected, inspect invalid_auth_tokens in the DB to see when/by whom it was revoked.","Ensure clients drop the cookie on 401 rather than retrying with the same token."],"exampleFix":"n/a","handlingStrategy":"try-catch","validationCode":"n/a (revocation table is server-side)","typeGuard":"function isAuthError(error: unknown): error is Error {\n  return error instanceof Error && error.message === 'Unauthorized';\n}","tryCatchPattern":"try {\n  await authService.authenticateUserBasedOnToken(token, method, endpoint, browserId);\n} catch (e) {\n  if (e instanceof AuthError) { /* token revoked or failed downstream checks: 401 the client */ }\n  else throw e;\n}","preventionTips":["Drop cookies on 401 and re-authenticate; never replay a revoked token.","Audit invalid_auth_tokens if revocations seem unexpected.","Rotate sessions after admin/credential changes."],"tags":["auth","revoked-token","http-401"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}