{"record":{"id":"eb07b20b53f909ec","repo":"BerriAI/litellm","slug":"plugin-session-claim-expired","errorCode":null,"errorMessage":"Plugin session claim expired","messagePattern":"Plugin session claim expired","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/proxy/plugin_routes.py","lineNumber":173,"sourceCode":"    return _plugin_fernet(plugin_name).encrypt(json.dumps(claim).encode()).decode()\n\n\ndef verify_plugin_session_claim(plugin_name: str, ciphertext: str) -> dict:\n    \"\"\"Verify and decode a plugin session claim.\n\n    Raises ValueError if the HMAC is invalid, the audience is wrong, or\n    the claim is expired.  Returns the decoded claim dict on success.\n    \"\"\"\n    try:\n        raw: Final = _plugin_fernet(plugin_name).decrypt(ciphertext.encode(), ttl=_CLAIM_TTL_SECONDS)\n        claim: Final = json.loads(raw)\n    except (InvalidToken, Exception) as exc:\n        raise ValueError(\"Invalid, tampered, or expired plugin session claim\") from exc\n\n    if claim.get(\"plugin\") != plugin_name:\n        raise ValueError(\"Plugin claim audience mismatch\")\n    if int(claim.get(\"exp\", 0)) < int(time.time()):\n        raise ValueError(\"Plugin session claim expired\")\n    return claim\n\n\n# ---------------------------------------------------------------------------\n# Config\n# ---------------------------------------------------------------------------\ndef register_plugins_from_config(general_settings: dict[str, object]) -> None:\n    \"\"\"Replace the plugin registry from general_settings.\n\n    Replaces (not merges) so plugins removed from config are immediately\n    unreachable without requiring a process restart.\n    \"\"\"\n    raw: Final = general_settings.get(\"plugins\")\n    entries: Final[list[object]] = raw if isinstance(raw, list) else []\n    new_registry: Final = {p.name: p for p in (PluginConfig.model_validate(entry) for entry in entries)}\n    _plugin_registry.clear()\n    _plugin_registry.update(new_registry)\n","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/plugin_routes.py#L155-L191","documentation":"Raised by verify_plugin_session_claim when Fernet decryption fails the TTL check: the plugin session claim was issued with _CLAIM_TTL_SECONDS lifetime and that window has elapsed, so the token must be re-fetched.","triggerScenarios":"Thrown at litellm/proxy/plugin_routes.py:173 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Refresh the plugin iframe/session from the UI to mint a new, unexpired claim."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}