hoppscotch/hoppscotch · error · UnauthorizedException

user/not_found

user/not_found

Error message

user/not_found

What it means

Thrown by JwtStrategy.validate when the access-token JWT decoded correctly (and carried a `sub`) but UserService.findUserById(payload.sub) returned None — no user row exists for that id. UnauthorizedException 401 'user/not_found'. The token was structurally valid but refers to a user the backend no longer knows.

Source

Thrown at packages/hoppscotch-backend/src/auth/strategies/jwt.strategy.ts:119

              (error) => {
                throw error;
              },
              (token) => {
                return token;
              },
            ),
          ),
      ]),
      secretOrKey: configService.get('INFRA.JWT_SECRET'),
    });
  }

  async validate(payload: AccessTokenPayload) {
    if (!payload) throw new ForbiddenException(INVALID_ACCESS_TOKEN);

    const user = await this.usersService.findUserById(payload.sub);
    if (O.isNone(user)) {
      throw new UnauthorizedException(USER_NOT_FOUND);
    }

    return user.value;
  }
}

View on GitHub (pinned to 1acb8a3a75)

Solutions

1. Clear the access_token and refresh_token cookies and re-authenticate.
2. If the user should exist, check findUserById in the DB directly and the soft-delete/hard-delete audit log.
3. Audit JWT_SECRET rotation — a leaked secret lets an attacker mint a `sub` for any id.
4. For test environments, reset cookies after re-seeding users.

async function userExists(usersService, uid: string): Promise<boolean> {
  const u = await usersService.findUserById(uid);
  return O.isSome(u);
}

const isUserNotFound = (e: { status?: number; message?: string }): boolean =>
  e?.status === 401 && e?.message === 'user/not_found';

try {
  return await guardedRoute();
} catch (e) {
  if (isUserNotFound(e)) {
    // clear cookies and redirect to login; token refers to a deleted user
  }
  throw e;
}

When it happens

Trigger: The user was deleted after the access token was issued; the token's `sub` was tampered with to a non-existent id that happened to pass signature (only possible if JWT_SECRET leaked); DB rebuild/restore that dropped users but left tokens in client cookies; multi-region replication lag.

Common situations: Admin deleted the user; user self-deleted; tenant purge; test DB reset without clearing browser cookies; lookalike id collision from a copy-paste.

Related errors

• auth/invalid_access_token
• auth/cookies_not_found
• auth/invalid_refresh_token
• auth/cookies_not_found
• auth/cookies_not_found

AI-assisted analysis of hoppscotch/hoppscotch@1acb8a3a75 (2026-08-12). Data as JSON: /api/errors/9b14cc4ee1ab5787. Report an issue: GitHub.