{"record":{"id":"a7167af0a298b3b7","repo":"owasp-amass/amass","slug":"createsession-status-s","errorCode":null,"errorMessage":"createSession: status=%s","messagePattern":"createSession: status=(.+?)","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"engine/api/client/v1/client.go","lineNumber":103,"sourceCode":"\traw, err := json.Marshal(config)\n\tif err != nil {\n\t\treturn uuid.UUID{}, err\n\t}\n\n\tresp, err := amasshttp.RequestWebPage(ctx, c.httpClient, &amasshttp.Request{\n\t\tMethod: http.MethodPost,\n\t\tBody:   string(raw),\n\t\tURL:    c.base + \"/sessions\",\n\t\tHeader: amasshttp.Header{\"Content-Type\": []string{\"application/json\"}},\n\t})\n\tif err != nil {\n\t\treturn uuid.UUID{}, err\n\t}\n\n\tif resp.StatusCode != http.StatusCreated {\n\t\tmsg, err := readJSONError(resp.Body)\n\t\tif err != nil {\n\t\t\treturn uuid.UUID{}, fmt.Errorf(\"createSession: status=%s\", resp.Status)\n\t\t}\n\t\treturn uuid.UUID{}, fmt.Errorf(\"createSession: status=%s error=%s\", resp.Status, msg)\n\t}\n\n\tvar out CreateSessionResponse\n\tif err := json.Unmarshal([]byte(resp.Body), &out); err != nil {\n\t\treturn uuid.UUID{}, err\n\t}\n\n\treturn uuid.Parse(out.SessionToken)\n}\n\n// Lists the active session and associated tokens on the server.\nfunc (c *Client) ListSessions(ctx context.Context) ([]uuid.UUID, error) {\n\tresp, err := amasshttp.RequestWebPage(ctx, c.httpClient, &amasshttp.Request{URL: c.base + \"/sessions/list\"})\n\tif err != nil {\n\t\treturn nil, err\n\t}","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/owasp-amass/amass/blob/79299dce87b0085db0f2f4ef3e9c52cccb49f514/engine/api/client/v1/client.go#L85-L121","documentation":"This error is returned by Client.CreateSession when the POST to {base}/api/v1/sessions returns an HTTP status other than 201 Created AND the response body could not be parsed as a JSON error envelope (readJSONError failed). The caller only gets the HTTP status string, with no server-supplied error detail, because the server responded with a non-JSON body (e.g. an HTML error page, empty body, or plain text).","triggerScenarios":"Calling Client.CreateSession when the amass server returns a non-201 status with a non-JSON body: server routing changed (wrong API version/path), a reverse proxy or gateway returns an HTML 502/504 error page, the server crashes and returns an empty 500 body, or authentication middleware returns a plain-text 401/403.","commonSituations":"Pointing NewClient at the wrong URL or port so a different service (or a proxy) answers; server version mismatch where /api/v1/sessions no longer exists (404 with HTML 404 page); infrastructure errors (502/503/504 from nginx/ALB); server not fully started or DB backend down causing a raw 500 without JSON.","solutions":["Check what the server actually returned: hit {base}/api/v1/health with Client.HealthCheck first to confirm you are talking to the right service.","Verify the NewClient base URL, port, and that the server is the expected amass API version (v1) — a 404 usually means wrong path or wrong server.","Inspect reverse-proxy/gateway logs if the status is 502/503/504; fix upstream connectivity or wait for the service to recover.","Check server-side logs at the time of the request to find the real error, since the body was not parseable JSON.","Update client and server to matching versions if the API surface changed; re-run the request."],"exampleFix":"// before: calling CreateSession blindly against an unverified endpoint\nc, _ := clientv1.NewClient(\"http://localhost:4000\")\ntok, err := c.CreateSession(ctx, cfg)\n\n// after: health-check and require JSON-capable server first\nc, _ := clientv1.NewClient(\"http://localhost:4000\")\nif !c.HealthCheck(ctx) {\n    return fmt.Errorf(\"amass API server unreachable at %s\", \"http://localhost:4000\")\n}\ntok, err := c.CreateSession(ctx, cfg)","handlingStrategy":"try-catch","validationCode":"// Before CreateSession, verify the endpoint is the amass v1 API\nif !client.HealthCheck(ctx) {\n    return fmt.Errorf(\"amass API server not reachable/healthy at configured URL\")\n}\n// Optionally probe the route\nresp, err := http.Get(baseURL + \"/api/v1/sessions/list\")\nif err == nil && resp.StatusCode == http.StatusNotFound {\n    return fmt.Errorf(\"server does not expose /api/v1 sessions endpoints\")\n}","typeGuard":null,"tryCatchPattern":"tok, err := client.CreateSession(ctx, cfg)\nif err != nil {\n    var opErr *net.OpError\n    if errors.As(err, &opErr) {\n        return fmt.Errorf(\"network/server problem reaching API: %w\", err)\n    }\n    if strings.Contains(err.Error(), \"createSession: status=\") &&\n        !strings.Contains(err.Error(), \"error=\") {\n        // non-JSON body: likely proxy/gateway page — log status and retry or fail fast\n        return fmt.Errorf(\"server returned non-JSON error body: %w\", err)\n    }\n    return err\n}","preventionTips":["Always call HealthCheck before the first API call to confirm you are talking to the expected server.","Pin the client and server to matching versions so /api/v1 routes exist.","Check proxy/gateway configs (nginx, ALB) for routes that swallow 5xx into HTML pages.","Watch server logs when this fires — the status string is the only clue since the body was not JSON.","Distinguish this variant (no 'error=' suffix) from the JSON-detail variant (163) in your error handling."],"tags":["http","api","session","go"],"backgroundTag":"http-error-response","analyzedSha":"79299dce87b0085db0f2f4ef3e9c52cccb49f514","analyzedAt":"2026-09-06T08:22:48.198Z","contentChangedAt":"2026-09-06T08:22:48.198Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}