{"record":{"id":"5d2b0f22f57ff19d","repo":"plandex-ai/plandex","slug":"no-token","errorCode":null,"errorMessage":"no token","messagePattern":"no token","errorType":"validation","errorClass":null,"httpStatus":401,"severity":"error","filePath":"app/server/handlers/auth_helpers.go","lineNumber":182,"sourceCode":"\tacceptHeader := r.Header.Get(\"Accept\")\n\tif acceptHeader == \"\" {\n\t\t// no accept header, not a browser request\n\t\tlog.Println(\"not a browser request\")\n\t\treturn nil\n\t}\n\n\tlog.Println(\"is browser - setting auth cookie\")\n\n\tif token == \"\" {\n\t\tauthHeader, err := GetAuthHeader(r)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error getting auth header: %v\", err)\n\t\t}\n\t\ttoken = authHeader.Token\n\t}\n\n\tif token == \"\" {\n\t\treturn fmt.Errorf(\"no token\")\n\t}\n\n\t// set authToken cookie\n\tauthHeader := shared.AuthHeader{\n\t\tToken: token,\n\t\tOrgId: orgId,\n\t}\n\n\tbytes, err := json.Marshal(authHeader)\n\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error marshalling auth header: %v\", err)\n\t}\n\n\t// base64 encode\n\ttoken = base64.URLEncoding.EncodeToString(bytes)\n\n\tvar domain string","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/plandex-ai/plandex/blob/e2d772072efadbe41d2946d97d79be55532dbab5/app/server/handlers/auth_helpers.go#L164-L200","documentation":"SetAuthCookieIfBrowser resolves the token either from the Authorization header or from callers (e.g. ValidateAndSignIn, org handlers); if after all sources the token is still empty, it refuses to set the auth cookie and returns this error.","triggerScenarios":"A call path provides neither an Authorization header token nor an explicit token/orgId argument — e.g. ValidateAndSignIn invoked with no auth header present, or GetOrgSessionHandler called without any token in context/cookie.","commonSituations":"User not signed in yet hitting an endpoint that requires a token, expired/cleared cookie while the client also sends no Authorization header, or handler wiring that forgot to pass the token argument.","solutions":["Sign in first (SignInHandler) to obtain a token before calling flows that set the auth cookie","Ensure the client sends 'Authorization: Bearer <token>' on requests needing a session","Check that cookies are enabled/sent by the browser and not stripped by SameSite/domain settings","Verify the calling handler passes the token parameter instead of an empty string","Redirect unauthenticated users to login instead of calling this function"],"exampleFix":"// before\nSetAuthCookieIfBrowser(w, r, \"\", orgId) // empty token → error\n// after\nif token == \"\" { http.Redirect(w, r, \"/login\", http.StatusUnauthorized); return }\nSetAuthCookieIfBrowser(w, r, token, orgId)","handlingStrategy":"validation","validationCode":"// before calling\nif token == \"\" {\n    if ah, _ := GetAuthHeader(r); ah != nil { token = ah.Token }\n}\nif token == \"\" { http.Redirect(w, r, \"/login\", http.StatusSeeOther); return } // skip SetAuthCookieIfBrowser\nSetAuthCookieIfBrowser(w, r, token, orgId)","typeGuard":null,"tryCatchPattern":"err := SetAuthCookieIfBrowser(w, r, token, orgId)\nif err != nil {\n    if err.Error() == \"no token\" { http.Error(w, \"not authenticated\", http.StatusUnauthorized); return }\n    http.Error(w, err.Error(), http.StatusInternalServerError)\n}","preventionTips":["Sign in before calling flows that set the auth cookie","Ensure clients send the Authorization header or cookies on every protected request","Check cookie settings (SameSite, Secure, domain) so browsers actually send the token","Never pass empty-string tokens to SetAuthCookieIfBrowser; guard upstream"],"tags":["go","auth","cookie","session"],"backgroundTag":"missing-auth-token","analyzedSha":"e2d772072efadbe41d2946d97d79be55532dbab5","analyzedAt":"2026-09-05T20:56:53.631Z","contentChangedAt":"2026-09-05T20:56:53.631Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}