{"record":{"id":"d4e7b4cb7e4c21fe","repo":"RocketChat/Rocket.Chat","slug":"error-parameter-required-d4e7b4","errorCode":"error-parameter-required","errorMessage":"x-auth-token is required","messagePattern":"x-auth-token is required","errorType":"exception","errorClass":"Meteor.Error","httpStatus":400,"severity":"error","filePath":"apps/meteor/server/api/v1/users.ts","lineNumber":1676,"sourceCode":"\t\t\tresponse: {\n\t\t\t\t200: ajv.compile<{ token: string; tokenExpires: string }>({\n\t\t\t\t\ttype: 'object',\n\t\t\t\t\tproperties: {\n\t\t\t\t\t\ttoken: { type: 'string' },\n\t\t\t\t\t\ttokenExpires: { type: 'string' },\n\t\t\t\t\t\tsuccess: { type: 'boolean', enum: [true] },\n\t\t\t\t\t},\n\t\t\t\t\trequired: ['token', 'tokenExpires', 'success'],\n\t\t\t\t\tadditionalProperties: false,\n\t\t\t\t}),\n\t\t\t\t401: validateUnauthorizedErrorResponse,\n\t\t\t},\n\t\t},\n\t\tasync function action() {\n\t\t\tconst xAuthToken = this.request.headers.get('x-auth-token') as string;\n\n\t\t\tif (!xAuthToken) {\n\t\t\t\tthrow new Meteor.Error('error-parameter-required', 'x-auth-token is required');\n\t\t\t}\n\t\t\tconst hashedToken = Accounts._hashLoginToken(xAuthToken);\n\n\t\t\tif (!(await Users.removeNonPATLoginTokensExcept(this.userId, hashedToken))) {\n\t\t\t\tthrow new Meteor.Error('error-invalid-user-id', 'Invalid user id');\n\t\t\t}\n\n\t\t\tconst me = (await Users.findOneById(this.userId, { projection: { 'services.resume.loginTokens': 1 } })) as Pick<IUser, 'services'>;\n\n\t\t\tvoid notifyOnUserChange({\n\t\t\t\tclientAction: 'updated',\n\t\t\t\tid: this.userId,\n\t\t\t\tdiff: { 'services.resume.loginTokens': me.services?.resume?.loginTokens },\n\t\t\t});\n\n\t\t\tconst token = me.services?.resume?.loginTokens?.find((token) => token.hashedToken === hashedToken);\n\n\t\t\tconst loginExp = settings.get<number>('Accounts_LoginExpiration');","sourceCodeStart":1658,"sourceCodeEnd":1694,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/e4b8178b205510181a96ceefee043d0abcd13e5a/apps/meteor/server/api/v1/users.ts#L1658-L1694","documentation":"Thrown by POST /api/v1/users.removeOtherSessions when the x-auth-token request header is absent. The endpoint keeps only the session that owns the supplied token and invalidates every other non-PAT login token, so without the header it cannot know which session to preserve and fails with error-parameter-required.","triggerScenarios":"POST users.removeOtherSessions with only the standard auth headers of a wrapper SDK that strips x-auth-token; sending X-Auth-Token with different casing handled upstream but the header dropped by a proxy; calling with a userId param but no token header.","commonSituations":"Custom fetch wrappers that whitelist Content-Type/X-Auth-Token inconsistently; reverse proxies or API gateways stripping x-auth-token; SDK versions that send the token in a different header name.","solutions":["Send the current session's auth token in the x-auth-token header exactly as returned by the login endpoint","Fix proxy/gateway configuration to forward x-auth-token","Use the official REST SDK which forwards the header automatically","Retry only after confirming the header arrives (log sanitized request headers server-side)"],"exampleFix":"// before\nawait fetch('/api/v1/users.removeOtherSessions', { method: 'POST', headers: { 'X-Auth-Token': token, 'X-User-Id': uid } }); // proxy strips header\n// after\nawait fetch('/api/v1/users.removeOtherSessions', { method: 'POST', headers: { 'x-auth-token': token, 'x-user-id': uid } });","handlingStrategy":"validation","validationCode":"if (!headers['x-auth-token']) throw new Error('x-auth-token header required for users.removeOtherSessions');\nawait sdk.post('users.removeOtherSessions', {}, { 'x-auth-token': authToken });","typeGuard":"const hasXAuthToken = (h: Record<string,string|undefined>): h is {'x-auth-token': string} => Boolean(h['x-auth-token']);","tryCatchPattern":"try { await sdk.post('users.removeOtherSessions', {}, headers); } catch (e) { if (e.response?.data?.errorType === 'error-parameter-required') { ensureHeaderForwarding(); } else throw e; }","preventionTips":["Configure proxies/gateways to forward x-auth-token","Use the official SDK which sets the header","Add an integration test asserting the header reaches the server"],"tags":["rest-api","auth-token","sessions","missing-header"],"backgroundTag":"missing-auth-header","analyzedSha":"e4b8178b205510181a96ceefee043d0abcd13e5a","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}