{"record":{"id":"6a350fd0ba7e446b","repo":"langflow-ai/langflow","slug":"no-client-id-cookie-found","errorCode":null,"errorMessage":"No client_id cookie found","messagePattern":"No client_id cookie found","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"src/backend/base/langflow/api/utils/flow_utils.py","lineNumber":248,"sourceCode":"    on the shareable playground.\n\n    Args:\n        flow_id: The original flow ID to verify\n        client_id: The client ID from the request cookie\n        authenticated_user_id: The authenticated user's ID (takes precedence over client_id)\n\n    Returns:\n        tuple: (flow owner user, deterministic flow ID for tracking)\n\n    Raises:\n        HTTPException:\n            - 400 if neither client_id nor authenticated_user_id is provided\n            - 403 if flow doesn't exist or isn't public\n            - 403 if unable to retrieve the flow owner user\n            - 403 if user is not found for public flow\n    \"\"\"\n    if not client_id and not authenticated_user_id:\n        raise HTTPException(status_code=400, detail=\"No client_id cookie found\")\n\n    # Check if the flow is public\n    async with session_scope() as session:\n        from sqlmodel import select\n\n        from langflow.services.database.models.flow.model import AccessTypeEnum, Flow\n\n        flow = (await session.exec(select(Flow).where(Flow.id == flow_id))).first()\n        if not flow or flow.access_type is not AccessTypeEnum.PUBLIC:\n            raise HTTPException(status_code=403, detail=\"Flow is not public\")\n\n    # Use authenticated user_id for deterministic UUID when available, otherwise client_id.\n    # Keep the branches explicit so identifier is non-optional at the UUID boundary.\n    if authenticated_user_id is not None:\n        identifier = str(authenticated_user_id)\n        principal_type: Literal[\"user\", \"client\"] = \"user\"\n    else:\n        if client_id is None:","sourceCodeStart":230,"sourceCodeEnd":266,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/utils/flow_utils.py#L230-L266","documentation":"verify_public_flow_and_get_user() requires some principal for anonymous shareable-playground requests: either a client_id cookie or an authenticated user. It raises 400 with 'No client_id cookie found' at the top of the function when both are absent, because every public-flow invocation must be attributable to a deterministic UUIDv5 virtual flow ID (per-session isolation).","triggerScenarios":"Calling a public flow execution endpoint (e.g. POST /api/v1/.../{flow_id} or the predictive-style build endpoint routed through verify_public_flow_and_get_user) with neither a client_id cookie in the request nor an authenticated session/Bearer token. Common with bare curl requests, server-to-server HTTP calls, or browsers that dropped/never set the client_id cookie.","commonSituations":"Testing a public flow URL with curl/Postman without first visiting the page that sets the client_id cookie; cookies blocked by third-party cookie policy when the flow is embedded in an iframe; a proxy or CORS configuration that strips Set-Cookie; calling the API from a backend script with no auth header.","solutions":["Visit the flow's public playground page once so the backend can set the client_id cookie, then replay the API call with cookie jar enabled (curl -c/-b, or credentials: 'include' in fetch).","Or send an authenticated request (login session cookie / Authorization header) so authenticated_user_id is populated instead.","For programmatic clients, generate and persist your own client_id cookie value (any unique string) and send it on every request — the server only needs a stable identifier.","If embedding in an iframe, ensure SameSite/None-Secure cookie attributes and third-party cookies are allowed, or pass an API token instead."],"exampleFix":"# before (no cookie, no auth -> 400)\ncurl -X POST https://host/api/v1/run/{flow_id} -d '{}'\n\n# after\ncurl -c jar.txt https://host/  # obtains client_id cookie\ncurl -b jar.txt -X POST https://host/api/v1/run/{flow_id} -d '{}'","handlingStrategy":"validation","validationCode":"def ensure_principal(client_id: str | None, token: str | None) -> str:\n    if token:\n        return 'auth'  # authenticated path, no cookie needed\n    if not client_id:\n        raise PermissionError('missing client_id cookie — visit the flow page first or send credentials')\n    return client_id","typeGuard":null,"tryCatchPattern":"try:\n    resp = await client.post(run_url, cookies={'client_id': cid})\nexcept HTTPStatusError as e:\n    if e.response.status_code == 400 and 'client_id' in e.response.text:\n        cid = str(uuid.uuid4())\n        resp = await client.post(run_url, cookies={'client_id': cid})\n    else:\n        raise","preventionTips":["Persist a client_id cookie across requests (curl -c/-b, fetch credentials:'include').","For programmatic access prefer an API token over anonymous cookies.","When embedding flows in iframes, verify third-party cookies are allowed or switch to token auth."],"tags":["public-flow","authentication","cookies","http-400","api"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}