{"record":{"id":"955c326ca6ea1f33","repo":"TechnitiumSoftware/DnsServer","slug":"access-was-denied-955c32","errorCode":null,"errorMessage":"Access was denied.","messagePattern":"Access was denied\\.","errorType":"http","errorClass":"DnsWebServiceException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/DnsWebService.cs","lineNumber":2630,"sourceCode":"            UserSession session = context.GetCurrentSession();\n\n            if ((session.Type == UserSessionType.ClusterApiToken) && _clusterManager.ClusterInitialized)\n            {\n                //proxy call from cluster node \n                string actingUsername = context.Request.GetQueryOrForm(\"actingUser\", null);\n                if (actingUsername is null)\n                    return session.User;\n\n                User actingUser = _authManager.GetUser(actingUsername);\n                if (actingUser is null)\n                    throw new DnsWebServiceException(\"No such user exists: \" + actingUsername);\n\n                return actingUser;\n            }\n            else\n            {\n                if (standardOnly && (session.Type != UserSessionType.Standard))\n                    throw new DnsWebServiceException(\"Access was denied.\");\n\n                return session.User;\n            }\n        }\n\n        #endregion\n\n        #region tls\n\n        private void StartTlsCertificateUpdateTimer()\n        {\n            if (_tlsCertificateUpdateTimer is null)\n            {\n                _tlsCertificateUpdateTimer = new Timer(delegate (object state)\n                {\n                    if (!string.IsNullOrEmpty(_webServiceTlsCertificatePath))\n                    {\n                        string webServiceTlsCertificatePath = ConvertToAbsolutePath(_webServiceTlsCertificatePath);","sourceCodeStart":2612,"sourceCodeEnd":2648,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/DnsWebService.cs#L2612-L2648","documentation":"DnsWebServiceException thrown by GetSessionUser when standardOnly is true but the session type is not UserSessionType.Standard. Some operations require a real interactive user session and reject API/cluster/SSO token types that do not represent a standard login.","triggerScenarios":"Calling an endpoint that passes standardOnly=true while authenticated with a non-standard session (e.g. a ClusterApiToken, single-use token, or other token type). The caller asked for a standard user but the session is a service token.","commonSituations":"Using an API token or cluster token to hit an endpoint that requires a human/standard session; scripting a UI-only flow with a service token; session type downgrade after token reissue.","solutions":["Authenticate as the user with a standard login (/api/user/login) and use that session for standardOnly endpoints.","Use a different endpoint that accepts the token session type, if one exists.","Confirm the session type expected by the endpoint and obtain the matching token kind."],"exampleFix":"null","handlingStrategy":"validation","validationCode":"// Use a standard login session for standardOnly endpoints\nif (session.Type != UserSessionType.Standard)\n    throw new UnauthorizedAccessException(\"This endpoint requires a standard session.\");","typeGuard":"static bool IsStandardSession(UserSession session) => session.Type == UserSessionType.Standard;","tryCatchPattern":"catch (DnsWebServiceException ex) when (ex.Message == \"Access was denied.\")\n{\n    // prompt the user to log in interactively\n}","preventionTips":["Reserve standardOnly endpoints for interactive user sessions.","Do not script UI-only flows with service/cluster tokens.","Document which session types each endpoint accepts."],"tags":["dns-server","technitium","auth","session","authorization","access-denied","csharp"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}