{"record":{"id":"cf2b6e1ab4b79e95","repo":"netbirdio/netbird","slug":"no-daemon-pipe-to-connect-to","errorCode":null,"errorMessage":"no daemon pipe to connect to","messagePattern":"no daemon pipe to connect to","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/internal/daemonaddr/pipe_windows.go","lineNumber":47,"sourceCode":"\n\t\t// A pipe in the protected namespace could only have been created by an\n\t\t// administrator or LocalSystem, so its name is the guarantee. Any other\n\t\t// name has to be checked, because any local user can create one.\n\t\tif !IsProtectedPipePath(path) {\n\t\t\tif err := ipcauth.PipeServerTrusted(conn); err != nil {\n\t\t\t\tif closeErr := conn.Close(); closeErr != nil {\n\t\t\t\t\tlog.Debugf(\"close untrusted pipe %s: %v\", path, closeErr)\n\t\t\t\t}\n\t\t\t\tlastErr = fmt.Errorf(\"%s: %w\", path, err)\n\t\t\t\tcontinue\n\t\t\t}\n\t\t}\n\n\t\treturn conn, nil\n\t}\n\n\tif lastErr == nil {\n\t\tlastErr = errors.New(\"no daemon pipe to connect to\")\n\t}\n\treturn nil, lastErr\n}\n\n// dialPipe connects to the daemon control pipe at SECURITY_IDENTIFICATION.\n// winio's plain DialPipe connects at SECURITY_ANONYMOUS, under which the daemon\n// cannot read the caller's token at all. Identification lets the daemon read the\n// caller's SID and groups without granting it the ability to act as the caller.\nfunc dialPipe(ctx context.Context, path string) (net.Conn, error) {\n\taccess := uint32(windows.GENERIC_READ | windows.GENERIC_WRITE)\n\treturn winio.DialPipeAccessImpLevel(ctx, path, access, winio.PipeImpLevelIdentification)\n}\n","sourceCodeStart":29,"sourceCodeEnd":60,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/internal/daemonaddr/pipe_windows.go#L29-L60","documentation":"The scheme-flow counterpart of index 6, in handleAuthenticatedToken (middleware.go:581): a form/login scheme produced a token (token != ''), validateSessionToken errored, and the error is not errValidationUnavailable — the token fails local validation (bad Ed25519 signature, malformed). Captured data gets OriginAuth and the scheme type, then 400 'invalid session token'.","triggerScenarios":"Submitting credentials through the domain's login page whose resulting token cannot be verified: token minted with a key other than the domain's SessionPublicKey (key rotation gap between management and proxy), token corrupted in transit, or token crafted for a different domain.","commonSituations":"Management rotated the session signing key but the proxy still holds the old SessionPublicKey from domain registration (re-sync never happened); stale login form resubmitted after a key change; proxy restarted with an outdated domain config.","solutions":["Re-register the domain (AddDomain) so the proxy holds the current SessionPublicKey from management.","Retry the login flow end-to-end to mint a token under the current keys.","Compare the session public key configured on the proxy with management's active signing key.","Check the underlying validateSessionToken error in proxy logs for 'malformed' vs 'signature'."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":"resp, err := client.PostForm(loginURL, creds)\nif err == nil && resp.StatusCode == http.StatusBadRequest {\n    // 400 'invalid session token' right after login: key skew between\n    // management (signer) and proxy (verifier). Re-sync the domain's session\n    // public key, then retry the whole login; the credentials are fine.\n}","preventionTips":["Re-register domains (AddDomain) after management session-key rotations so SessionPublicKey stays current.","Automate the key re-sync step as part of key rotation runbooks.","Retry login end-to-end after any management/proxy reconfiguration.","Check proxy logs to confirm 'malformed' vs 'signature verification failed' before assuming key skew."],"tags":["proxy","session-token","ed25519","authentication"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}