{"record":{"id":"e3fd6302f32e51ec","repo":"alibaba/arthas","slug":"sessionid-is-required","errorCode":null,"errorMessage":"'sessionId' is required","messagePattern":"'sessionId' is required","errorType":"http","errorClass":"ApiException","httpStatus":200,"severity":"error","filePath":"core/src/main/java/com/taobao/arthas/core/shell/term/impl/http/api/HttpApiHandler.java","lineNumber":141,"sourceCode":"            ApiAction action;\n            try {\n                action = ApiAction.valueOf(actionStr.trim().toUpperCase());\n            } catch (IllegalArgumentException e) {\n                throw new ApiException(\"unknown action: \" + actionStr);\n            }\n\n            //no session required\n            if (ApiAction.INIT_SESSION.equals(action)) {\n                return processInitSessionRequest(apiRequest);\n            }\n\n            //required session\n            Session session = null;\n            boolean allowNullSession = ApiAction.EXEC.equals(action);\n            String sessionId = apiRequest.getSessionId();\n            if (StringUtils.isBlank(sessionId)) {\n                if (!allowNullSession) {\n                    throw new ApiException(\"'sessionId' is required\");\n                }\n            } else {\n                session = sessionManager.getSession(sessionId);\n                if (session == null) {\n                    throw new ApiException(\"session not found: \" + sessionId);\n                }\n                sessionManager.updateAccessTime(session);\n            }\n\n            // 标记所谓的一次性session\n            if (session == null) {\n                session = sessionManager.createSession();\n                session.put(ONETIME_SESSION_KEY, new Object());\n            }\n\n            // 请求到达这里，如果有需要鉴权，则已经在前面的handler里处理过了\n            // 如果有鉴权取到的 Subject，则传递到 arthas的session里\n            HttpSession httpSession = HttpSessionManager.getHttpSessionFromContext(ctx);","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/alibaba/arthas/blob/21cf2e9ba52b305290be7223b980ff504bb9cb5b/core/src/main/java/com/taobao/arthas/core/shell/term/impl/http/api/HttpApiHandler.java#L123-L159","documentation":"Thrown when the 'sessionId' field is blank and the action is not EXEC (EXEC is the only action allowed to create an implicit one-time session without a pre-existing sessionId). All other actions (JOIN_SESSION, PULL_RESULTS, INTERRUPT_JOB, CLOSE_SESSION, SESSION_INFO) require an existing session.","triggerScenarios":"Calling PULL_RESULTS, JOIN_SESSION, INTERRUPT_JOB, CLOSE_SESSION, or SESSION_INFO without providing a sessionId in the request body.","commonSituations":"Client forgets to carry the sessionId returned by a prior INIT_SESSION call. Session management logic drops the sessionId between requests.","solutions":["Call INIT_SESSION first and capture the returned sessionId, then include it in all subsequent requests.","For EXEC, sessionId is optional (a one-time session is created automatically), but for all other actions it is mandatory."],"exampleFix":"// before: pull_results without sessionId\n{\"action\": \"pull_results\", \"consumerId\": \"abc\"}\n// -> 'sessionId' is required\n\n// after\n{\"action\": \"pull_results\", \"sessionId\": \"<from init_session>\", \"consumerId\": \"abc\"}","handlingStrategy":"validation","validationCode":"// Client-side: ensure sessionId for non-EXEC actions\nif (!\"EXEC\".equals(action.toUpperCase()) &&\n        (sessionId == null || sessionId.trim().isEmpty())) {\n    throw new IllegalArgumentException(\"'sessionId' is required for \" + action);\n}","typeGuard":"boolean needsSessionId(String action) {\n    return !\"EXEC\".equalsIgnoreCase(action);\n}","tryCatchPattern":null,"preventionTips":["Call INIT_SESSION first and retain the sessionId.","Pass sessionId in all requests except standalone EXEC."],"tags":["http-api","session","request-validation"],"backgroundTag":null,"analyzedSha":"21cf2e9ba52b305290be7223b980ff504bb9cb5b","analyzedAt":"2026-08-14T00:57:07.243Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}