{"record":{"id":"9c44251fc6e9f71a","repo":"louislam/uptime-kuma","slug":"you-are-not-logged-in","errorCode":null,"errorMessage":"You are not logged in.","messagePattern":"You are not logged in\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"server/util-server.js","lineNumber":646,"sourceCode":" * Allow CORS all origins\n * @param {object} res Response object from axios\n * @returns {void}\n */\nexports.allowAllOrigin = (res) => {\n    res.header(\"Access-Control-Allow-Origin\", \"*\");\n    res.header(\"Access-Control-Allow-Methods\", \"GET, PUT, POST, DELETE, OPTIONS\");\n    res.header(\"Access-Control-Allow-Headers\", \"Origin, X-Requested-With, Content-Type, Accept\");\n};\n\n/**\n * Check if a user is logged in\n * @param {Socket} socket Socket instance\n * @returns {void}\n * @throws The user is not logged in\n */\nexports.checkLogin = (socket) => {\n    if (!socket.userID) {\n        throw new Error(\"You are not logged in.\");\n    }\n};\n\n/**\n * For logged-in users, double-check the password\n * @param {Socket} socket Socket.io instance\n * @param {string} currentPassword Password to validate\n * @returns {Promise<Bean>} User\n * @throws The current password is not a string\n * @throws The provided password is not correct\n */\nexports.doubleCheckPassword = async (socket, currentPassword) => {\n    if (typeof currentPassword !== \"string\") {\n        throw new Error(\"Wrong data type?\");\n    }\n\n    let user = await R.findOne(\"user\", \" id = ? AND active = 1 \", [socket.userID]);\n","sourceCodeStart":628,"sourceCodeEnd":664,"githubUrl":"https://github.com/louislam/uptime-kuma/blob/6b5ea0155793e666666745fb8d6fef1e829543a2/server/util-server.js#L628-L664","documentation":"Thrown by exports.checkLogin(socket) in util-server.js when `socket.userID` is falsy. It is the universal authentication gate invoked at the top of nearly every socket handler (status-page, maintenance, proxy, server.js, etc.). The check relies on the socket middleware that sets socket.userID after verifying the session/JWT, so a missing userID means the connection is unauthenticated.","triggerScenarios":"Emitting any authenticated socket event (e.g. \"addMonitor\", \"saveStatusPage\", \"getMonitorList\") on a socket that never completed login, whose session expired, whose auth token was cleared, or where the auth middleware failed to attach userID. Also triggered when a browser tab is left open past session expiry and then performs an action.","commonSituations":"Token expiry in a long-opened browser tab; cookie not sent cross-origin; reverse proxy stripping the auth header/cookie; load balancer stickiness lost so the socket lands on an instance without the session; client reconnect after server restart without re-auth; misconfigured trustProxy breaking the session binding.","solutions":["Re-authenticate (socket.emit(\"login\", ...)) on reconnect and whenever an event returns this error.","Ensure the auth cookie/token is sent with the Socket.IO handshake (withCredentials / transport options).","Verify the session store is shared across all instances behind a load balancer.","Set trustProxy correctly so the socket middleware can validate the session."],"exampleFix":"// before\nsocket.emit(\"saveStatusPage\", ...); // fired without login -> throws \"You are not logged in.\"\n\n// after\nsocket.on(\"connect\", async () => {\n  await new Promise((res, rej) => socket.emit(\"login\", { username, password, token }, (r) => r.ok ? res() : rej(r)));\n  socket.emit(\"saveStatusPage\", ...);\n});","handlingStrategy":"try-catch","validationCode":"if (!socket.userID) { socket.emit(\"loginRequired\"); return; }","typeGuard":"const isAuthenticated = (socket) => !!(socket && socket.userID);","tryCatchPattern":"try { checkLogin(socket); } catch (e) { if (e.message === \"You are not logged in.\") { await reAuthenticate(socket); return; } throw e; }","preventionTips":["Re-authenticate on reconnect and on this error.","Send the auth cookie/token with the Socket.IO handshake.","Share the session store across instances behind a load balancer."],"tags":["auth","socket","session","uptime-kuma"],"backgroundTag":null,"analyzedSha":"6b5ea0155793e666666745fb8d6fef1e829543a2","analyzedAt":"2026-08-12T23:42:12.959Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}