{"record":{"id":"d4e7b4cb7e4c21fe","repo":"RocketChat/Rocket.Chat","slug":"error-parameter-required-d4e7b4","errorCode":"error-parameter-required","errorMessage":"x-auth-token is required","messagePattern":"x-auth-token is required","errorType":"exception","errorClass":"Meteor.Error","httpStatus":400,"severity":"error","filePath":"apps/meteor/server/api/v1/users.ts","lineNumber":1644,"sourceCode":"\t\t\tresponse: {\n\t\t\t\t200: ajv.compile<{ token: string; tokenExpires: string }>({\n\t\t\t\t\ttype: 'object',\n\t\t\t\t\tproperties: {\n\t\t\t\t\t\ttoken: { type: 'string' },\n\t\t\t\t\t\ttokenExpires: { type: 'string' },\n\t\t\t\t\t\tsuccess: { type: 'boolean', enum: [true] },\n\t\t\t\t\t},\n\t\t\t\t\trequired: ['token', 'tokenExpires', 'success'],\n\t\t\t\t\tadditionalProperties: false,\n\t\t\t\t}),\n\t\t\t\t401: validateUnauthorizedErrorResponse,\n\t\t\t},\n\t\t},\n\t\tasync function action() {\n\t\t\tconst xAuthToken = this.request.headers.get('x-auth-token') as string;\n\n\t\t\tif (!xAuthToken) {\n\t\t\t\tthrow new Meteor.Error('error-parameter-required', 'x-auth-token is required');\n\t\t\t}\n\t\t\tconst hashedToken = Accounts._hashLoginToken(xAuthToken);\n\n\t\t\tif (!(await Users.removeNonPATLoginTokensExcept(this.userId, hashedToken))) {\n\t\t\t\tthrow new Meteor.Error('error-invalid-user-id', 'Invalid user id');\n\t\t\t}\n\n\t\t\tconst me = (await Users.findOneById(this.userId, { projection: { 'services.resume.loginTokens': 1 } })) as Pick<IUser, 'services'>;\n\n\t\t\tvoid notifyOnUserChange({\n\t\t\t\tclientAction: 'updated',\n\t\t\t\tid: this.userId,\n\t\t\t\tdiff: { 'services.resume.loginTokens': me.services?.resume?.loginTokens },\n\t\t\t});\n\n\t\t\tconst token = me.services?.resume?.loginTokens?.find((token) => token.hashedToken === hashedToken);\n\n\t\t\tconst loginExp = settings.get<number>('Accounts_LoginExpiration');","sourceCodeStart":1626,"sourceCodeEnd":1662,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/server/api/v1/users.ts#L1626-L1662","documentation":"Thrown by the logout-other-clients endpoint when the x-auth-token request header is missing or empty. The handler needs the raw token to hash it and keep the current session while invalidating the others.","triggerScenarios":"POST users.logoutOtherClients (or equivalent) without the x-auth-token header, or with an empty value.","commonSituations":"Client sent only the auth cookie / userId+token in the body but not the header; reverse proxy stripped the header; SDK misconfiguration.","solutions":["Include the x-auth-token: <login token> header on the request (alongside the normal X-Auth-Token / X-User-Id pair used by the REST API).","Ensure no proxy/middleware strips custom headers.","Confirm the SDK reads the token from storage and sets it on the request."],"exampleFix":"// before\nawait POST('users.logoutOtherClients');\n\n// after\nawait POST('users.logoutOtherClients', {}, { headers: { 'x-auth-token': loginToken } });","handlingStrategy":"validation","validationCode":"if (!headers['x-auth-token']) { setError('x-auth-token header is required'); return; }\nawait POST('users.logoutOtherClients', {}, { headers });","typeGuard":"const hasAuthTokenHeader = (h: Record<string, string | undefined>): h is { 'x-auth-token': string } & Record<string, string | undefined> =>\n  typeof h['x-auth-token'] === 'string' && h['x-auth-token'].length > 0;","tryCatchPattern":"null","preventionTips":["Centralize request building in an SDK that always attaches x-auth-token.","Ensure proxies preserve custom headers."],"tags":["users","sessions","headers","api","authentication"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}