{"record":{"id":"e7c1661fe4d9527d","repo":"microsoft/aspire","slug":"failed-to-authenticate-to-apphost-w","errorCode":null,"errorMessage":"failed to authenticate to AppHost: %w","messagePattern":"failed to authenticate to AppHost: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/Aspire.Hosting.CodeGeneration.Go/Resources/transport.go","lineNumber":644,"sourceCode":"\t\treturn fmt.Errorf(\"failed to connect to AppHost: %w\", err)\n\t}\n\n\tauthToken := os.Getenv(\"ASPIRE_REMOTE_APPHOST_TOKEN\")\n\tif authToken == \"\" {\n\t\tcErr := rawConn.Close()\n\t\tc.mu.Unlock()\n\t\treturn errors.Join(errors.New(\"ASPIRE_REMOTE_APPHOST_TOKEN environment variable is not set\"), cErr)\n\t}\n\n\tconn := newConnection(rawConn, c, c.onConnectionClose)\n\tc.conn = conn\n\tc.mu.Unlock()\n\n\tconn.start()\n\n\tif err := c.authenticate(ctx, authToken); err != nil {\n\t\tc.disconnect()\n\t\treturn fmt.Errorf(\"failed to authenticate to AppHost: %w\", err)\n\t}\n\n\treturn nil\n}\n\n// onDisconnect registers a callback to be invoked exactly once when the\n// connection is closed.\nfunc (c *client) onDisconnect(callback func()) {\n\tc.mu.Lock()\n\tc.disconnectCallbacks = append(c.disconnectCallbacks, callback)\n\tc.mu.Unlock()\n}\n\n// invokeCapability invokes a capability on the server. The supplied context\n// drives both server-side cancellation (if a CancellationToken is registered\n// in args) and local short-circuit on cancel.\nfunc (c *client) invokeCapability(ctx context.Context, capabilityID string, args map[string]any) (any, error) {\n\tif err := validateCapabilityArgs(capabilityID, args); err != nil {","sourceCodeStart":626,"sourceCodeEnd":662,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.CodeGeneration.Go/Resources/transport.go#L626-L662","documentation":"After the socket connection succeeds, connect authenticates using the ASPIRE_REMOTE_APPHOST_TOKEN environment variable. If c.authenticate fails (wrong, missing, or expired token, or protocol mismatch during handshake), the connection is torn down and the cause is wrapped as \"failed to authenticate to AppHost: %w\".","triggerScenarios":"ASPIRE_REMOTE_APPHOST_TOKEN is empty or doesn't match the token the AppHost expects; connecting to an AppHost from a different session/run whose token differs; authenticate handshake times out or the AppHost rejects the auth frame.","commonSituations":"Manually running the Go project with a stale token from a previous `aspire run` session; copying env vars between machines; AppHost regenerated its token after restart while the client kept the old value.","solutions":["Run the project through `aspire run` so ASPIRE_REMOTE_APPHOST_TOKEN is injected fresh and matches the current AppHost.","Never hardcode or copy the token between sessions; it is per-run.","Log the unwrapped error to distinguish bad token vs handshake/timeout failure.","Restart both AppHost and project together so token and socket stay in sync."],"exampleFix":"// before\nauthToken := os.Getenv(\"ASPIRE_REMOTE_APPHOST_TOKEN\")\n// after\nauthToken := os.Getenv(\"ASPIRE_REMOTE_APPHOST_TOKEN\")\nif authToken == \"\" {\n    return fmt.Errorf(\"ASPIRE_REMOTE_APPHOST_TOKEN is not set; launch via `aspire run` instead of running directly\")\n}","handlingStrategy":"try-catch","validationCode":"if os.Getenv(\"ASPIRE_REMOTE_APPHOST_TOKEN\") == \"\" {\n    log.Fatal(\"ASPIRE_REMOTE_APPHOST_TOKEN missing; launch via `aspire run`\")\n}","typeGuard":null,"tryCatchPattern":"app, err := aspire.CreateBuilder(ctx)\nif err != nil && strings.Contains(err.Error(), \"failed to authenticate\") {\n    log.Fatal(\"stale or missing ASPIRE_REMOTE_APPHOST_TOKEN; restart via `aspire run`\")\n}","preventionTips":["Treat the token as per-run; never copy or hardcode it.","Restart client and AppHost together so token and socket stay paired.","Launch only through `aspire run` so env injection happens automatically.","Add a pre-flight check for the token env var before connecting."],"tags":["go","aspire","authentication","security","apphost"],"backgroundTag":"authentication-required","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}